Downloaded 143 times
![1. Attributes can be fetched remotely = good for federated applications
2. You do not need the identity of the subject = good for privacy
3. As a researcher, it looks future-proof
a. ABAC supports many advanced policies, e.g., history-based policies, dynamic separation
of duty and breaking-the-glass procedures, …
b. Many of the newest access control models can be mapped on attributes, e.g., ReBAC,
EBAC [Bogaerts2015], obligations [Park2004], ...
c. A lot is still happening in this field, e.g., formal definition of this model and its properties (e.g.,
[Jin2012a]), languages for expressing attribute-based rules (e.g., [XACML, Crampton2012]), mutable
attributes (e.g., [Park2004]), attribute aggregation in federated identity management (e.g.,
[Chadwick2009]), encryption of attributes (e.g., [Asghar2011]), policy engineering for ABAC (e.g..,
[Krau2013]), performance (e.g., [Brucker2010]), …
Attributes as an enabler for the future
16](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-16-320.jpg)
![Migrating from RBAC to ABAC
Conceptually, three approaches:
18
[Kuhn2010]
2. Dynamic roles1. Roles as an attribute 3. Constrain roles
Manager
Helpdesk
operator
Accountant
Secretary
subject.roles
owns_doc...
Identity
Location
Department
Manager
Helpdes
k
operator
Accountant
Secretar
y
owns_doc...
Identity
Location
Department
Manager
A.read B.read
B.write ...](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-18-320.jpg)
![20
Source: [NIST2014]](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-20-320.jpg)
![22
Establish a
business case for
ABAC
Understand your
operational
requirements
Technical
implementation
Deploy or adjust
business
processes
Source: [NIST2014]
Initiation Implementation Maintenance Disposal
Ensure quality
Migrating from RBAC to ABAC, revised](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-22-320.jpg)
![23
Establish a
business case for
ABAC
Understand your
operational
requirements
Technical
implementation
Deploy or adjust
business
processes
Source: [NIST2014]
Initiation Implementation Maintenance Disposal
Ensure quality
Migrating from RBAC to ABAC, revised
Work incrementally
You probably already have
many of the required
processes](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-23-320.jpg)
![References
[Asghar2011] Asghar, Muhammad Rizwan, et al. "Espoon: Enforcing encrypted security policies in outsourced
environments." 2011
[Bogaerts2015] Bogaerts, Jasper, et al. "Entity-Based Access Control: supporting more expressive access control
policies." 2015.
[Brucker2010] Brucker, Achim D., and Helmut Petritsch. "Idea: efficient evaluation of access control constraints." 2010
[Chadwick2009] Chadwick, David W., and George Inman. "Attribute aggregation in federated identity management."
2009
[Crampton2012] Crampton, Jason, and Charles Morisset. "PTaCL: A language for attribute-based access control in open
systems." 2012
[Fong2011] Fong, Philip WL. "Relationship-based access control: protection model and policy language." ACM, 2011.
27](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-27-320.jpg)
![References (continued)
[Fong2011] Fong, Philip WL. "Relationship-based access control: protection model and policy language." ACM, 2011.
[Jin2012a] Jin, Xin, Ram Krishnan, and Ravi S. Sandhu. "A Unified Attribute-Based Access Control Model Covering DAC,
MAC and RBAC." 2012
[Jin2012b] Jin, Xin, Ravi Sandhu, and Ram Krishnan. "RABAC: role-centric attribute-based access control." 2012
[Krau2013] Krautsevich, Leanid, et al. "Towards policy engineering for attribute-based access control." 2013
[Kuhn2010] Kuhn, D. Richard, Edward J. Coyne, and Timothy R. Weil. "Adding attributes to role-based access control."
2010
[Park2004] Park, Jaehong, and Ravi Sandhu. "The UCON ABC usage control model." 2004
[XACML] eXtensible Access Control Markup Language (XACML) Version 3.0. 2013. OASIS Standard
28](https://image.slidesharecdn.com/attribute-basedaccesscontrol-160622101858/85/Attribute-based-access-control-28-320.jpg)
Uploaded byElimity
Attribute based access control
The document discusses various access control models, emphasizing attribute-based access control (ABAC) as a flexible alternative to traditional role-based approaches. It highlights the challenges of role-based access control, such as role explosion, and presents the advantages of ABAC, including fine-grained and dynamic access control. The conclusion mentions the need for careful planning and incremental implementation when transitioning to ABAC in enterprises.
More Related Content
![Carlos García - Pentesting Active Directory [rooted2018]](https://cdn.slidesharecdn.com/ss_thumbnails/carlosgarcia-slides-180312234839-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Attribute based access control
![Security policy(DAS, MAS, PAS) model [in]](https://cdn.slidesharecdn.com/ss_thumbnails/lectureno05-260108015939-e0fede22-thumbnail.jpg?width=640&height=640&fit=bounds)
Attribute based access control
- 1. Attribute-based access control Maarten Decat,iMinds-DistriNet maarten.decat@kuleuven.be, @maartendecat
- 2. Access control models How to express whocan do what 2
- 3. Access control models How to express whocan do what Access control lists Mandatory access control (MAC) Discretionary access control (DAC) Role-based access control (RBAC) Information flow control Attribute- based access control Relationship- based access control Access control matrix Entity-based access control The Bibamodel The Bell-LaPadulamodel 3
- 4.
- 5. The problem withrole-based access control 5Role explosion
- 6. The problem withrole-based access control Manager Helpdesk operator Developer Secretary Accountant 6
- 7. The problem withrole-based access control Manager Helpdesk operator Developer Secretary Accountant Manager of R&D dept Manager of finance deptManager of sales dept Secretary with color print Secretary with- out color print 7
- 8. The problem withrole-based access control Manager Helpdesk operator Developer Secretary Accountant Manager of R&D dept Manager of finance deptManager of sales dept Secretary with color print Secretary with- out color print owns_docA owns_docB owns_docC owns_docD owns_docE owns_docF owns_docG owns_doc... 8
- 9. The problem withrole-based access control Manager Helpdesk operator Developer Secretary Accountant Manager of R&D dept Manager of finance deptManager of sales dept Secretary with color print Secretary with- out color print owns_docA owns_docB owns_docC owns_docD owns_docE owns_docF owns_docG owns_doc... Secretary of finance dept with color print owns docE Secretary of sales dept with color print owns docE Helpdesk operator assigned to Customer A Helpdesk operator assigned to Customer B Helpdesk operator assigned to Customer C Helpdesk operator assigned to Customer D Secretary of finance dept with color print owns docD Secretary of sales dept with color print owns docD Secretary of sales dept without color print owns docD Secretary of sales dept without color print owns docE Secretary of finance dept without color print owns docE Secretary of sales dept without color print owns docB Secretary of finance dept without color print owns docD Secretary of sales dept with color print owns docB Secretary of finance dept without color print owns docB Secretary of sales dept with color print owns docA Secretary of sales dept without color print owns docA Secretary of finance dept without color print owns docA Secretary of sales dept without color print owns docC Secretary of finance dept with color print owns docA Secretary of sales dept with color print owns docC Secretary of finance dept without color print owns docC Secretary of finance dept with color print owns docC Secretary of finance dept with color print owns docB ... 9
- 10. Manager Helpdesk operator Developer Secretary Accountant Manager of R&D dept Managerof finance deptManager of sales dept Secretary with color print Secretary with- out color print owns_docA owns_docB owns_docC owns_docD owns_docE owns_docF owns_docG owns_doc... Secretary of finance dept with color print owns docE Secretary of sales dept with color print owns docE Helpdesk operator assigned to Customer A Helpdesk operator assigned to Customer B Helpdesk operator assigned to Customer C Helpdesk operator assigned to Customer D Secretary of finance dept with color print owns docD Secretary of sales dept with color print owns docD Secretary of sales dept without color print owns docD Secretary of sales dept without color print owns docE Secretary of finance dept without color print owns docE Secretary of sales dept without color print owns docB Secretary of finance dept without color print owns docD Secretary of sales dept with color print owns docB Secretary of finance dept without color print owns docB Secretary of sales dept with color print owns docA Secretary of sales dept without color print owns docA Secretary of finance dept without color print owns docA Secretary of sales dept without color print owns docC Secretary of finance dept with color print owns docA Secretary of sales dept with color print owns docC Secretary of finance dept without color print owns docC Secretary of finance dept with color print owns docC Secretary of finance dept with color print owns docB ... The problem with role-based access control 10 read write read write read write Manager
- 11. Attribute-based access control Identity Location Department Type Date Conf.label Action Action Type Environment Device Type Timestamp System state Managers of the auditing department in Brussels can inspect the financial reports from the current financial year within office hours Subject Resource Amount 11
- 12. Attribute-based access control Managersof the auditing department in Brussels can inspect the financial reports from the current financial year within office hours 12 1. fine-grained access control 2. context-aware access control 3. dynamic access control
- 13. ABAC in anenterprise 13 CISO Business policy Employees GovernanceOperational x x ? ? Application policy Access requests x Systematic access reviews x
- 14. Attributes for accessmanagement User Guard Asset Action Security manager Manage employee infoManage security info HR administrator Roles & entitlements Manage roles and entitlements 14
- 15. Attributes as accessmanagement User Asset Guard Action Security manager Manage employee info HR administrator Security rules Attributes 15
- 16. 1. Attributes canbe fetched remotely = good for federated applications 2. You do not need the identity of the subject = good for privacy 3. As a researcher, it looks future-proof a. ABAC supports many advanced policies, e.g., history-based policies, dynamic separation of duty and breaking-the-glass procedures, … b. Many of the newest access control models can be mapped on attributes, e.g., ReBAC, EBAC [Bogaerts2015], obligations [Park2004], ... c. A lot is still happening in this field, e.g., formal definition of this model and its properties (e.g., [Jin2012a]), languages for expressing attribute-based rules (e.g., [XACML, Crampton2012]), mutable attributes (e.g., [Park2004]), attribute aggregation in federated identity management (e.g., [Chadwick2009]), encryption of attributes (e.g., [Asghar2011]), policy engineering for ABAC (e.g.., [Krau2013]), performance (e.g., [Brucker2010]), … Attributes as an enabler for the future 16
- 17. Migrating from RBACto ABAC 17
- 18. Migrating from RBACto ABAC Conceptually, three approaches: 18 [Kuhn2010] 2. Dynamic roles1. Roles as an attribute 3. Constrain roles Manager Helpdesk operator Accountant Secretary subject.roles owns_doc... Identity Location Department Manager Helpdes k operator Accountant Secretar y owns_doc... Identity Location Department Manager A.read B.read B.write ...
- 19. Not all rainbowsand unicorns 19
- 20.
- 21. “Enterprise ABAC carrieswith it significant development, implementation, and operations costs as well as a paradigm shift in the way enterprise objects are shared and protected.” -- NIST 21
- 22. 22 Establish a business casefor ABAC Understand your operational requirements Technical implementation Deploy or adjust business processes Source: [NIST2014] Initiation Implementation Maintenance Disposal Ensure quality Migrating from RBAC to ABAC, revised
- 23. 23 Establish a business casefor ABAC Understand your operational requirements Technical implementation Deploy or adjust business processes Source: [NIST2014] Initiation Implementation Maintenance Disposal Ensure quality Migrating from RBAC to ABAC, revised Work incrementally You probably already have many of the required processes
- 24.
- 25. Conclusion ABAC brings manyinteresting improvements compared to previous models: ● Support more fine-grained access rules ● Separation of concerns between user management and security ● Enables many advanced features As a result, ABAC is seen by many as the next step in access control. However, introducing ABAC in an enterprise is not an easy step to take. ● Plan ahead, get everyone involved, start small and work incrementally 25
- 26. Future reading NIST, Guideto Attribute Based Access Control (ABAC) Definition and Considerations http://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.sp.800-162.pdf 26
- 27. References [Asghar2011] Asghar, MuhammadRizwan, et al. "Espoon: Enforcing encrypted security policies in outsourced environments." 2011 [Bogaerts2015] Bogaerts, Jasper, et al. "Entity-Based Access Control: supporting more expressive access control policies." 2015. [Brucker2010] Brucker, Achim D., and Helmut Petritsch. "Idea: efficient evaluation of access control constraints." 2010 [Chadwick2009] Chadwick, David W., and George Inman. "Attribute aggregation in federated identity management." 2009 [Crampton2012] Crampton, Jason, and Charles Morisset. "PTaCL: A language for attribute-based access control in open systems." 2012 [Fong2011] Fong, Philip WL. "Relationship-based access control: protection model and policy language." ACM, 2011. 27
- 28. References (continued) [Fong2011] Fong,Philip WL. "Relationship-based access control: protection model and policy language." ACM, 2011. [Jin2012a] Jin, Xin, Ram Krishnan, and Ravi S. Sandhu. "A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC." 2012 [Jin2012b] Jin, Xin, Ravi Sandhu, and Ram Krishnan. "RABAC: role-centric attribute-based access control." 2012 [Krau2013] Krautsevich, Leanid, et al. "Towards policy engineering for attribute-based access control." 2013 [Kuhn2010] Kuhn, D. Richard, Edward J. Coyne, and Timothy R. Weil. "Adding attributes to role-based access control." 2010 [Park2004] Park, Jaehong, and Ravi Sandhu. "The UCON ABC usage control model." 2004 [XACML] eXtensible Access Control Markup Language (XACML) Version 3.0. 2013. OASIS Standard 28
- 29. Attribute-based access control Any furtherquestions? Contact us at maarten.decat@kuleuven.be or @maartendecat Interested in our events? Subscribe here http://bit.ly/DistrinetAccessControl