[Paper Review] Mining Attribute-based Access Control Policies

Zhongyuan Xu, Scott D. Stoller|arXiv (Cornell University)|Jun 11, 2013

Access Control and Trust15 references6 citations

TL;DR

This paper presents the first ABAC policy mining algorithm that automatically generates attribute-based access control policies from access control lists (ACLs) and user/resource attribute data. It works by using user-permission tuples as seeds to generate and generalize candidate rules, then merges and simplifies them to produce a compact, high-quality policy, significantly reducing manual effort in ABAC policy development.

ABSTRACT

Attribute-based access control (ABAC) provides a high level of flexibility that promotes security and information sharing. ABAC policy mining algorithms have potential to significantly reduce the cost of migration to ABAC, by partially automating the development of an ABAC policy from an access control list (ACL) policy or role-based access control (RBAC) policy with accompanying attribute data. This paper presents an ABAC policy mining algorithm. To the best of our knowledge, it is the first ABAC policy mining algorithm. Our algorithm iterates over tuples in the given user-permission relation, uses selected tuples as seeds for constructing candidate rules, and attempts to generalize each candidate rule to cover additional tuples in the user-permission relation by replacing conjuncts in attribute expressions with constraints. Our algorithm attempts to improve the policy by merging and simplifying candidate rules, and then it selects the highest-quality candidate rules for inclusion in the generated policy.

Motivation & Objective

• To address the high cost and complexity of manually creating ABAC policies.
• To enable automated migration from legacy access control models like ACLs and RBAC to ABAC.
• To develop a policy mining algorithm that produces concise, high-quality ABAC policies from low-level access data.
• To improve policy manageability by minimizing policy size and complexity.

Proposed method

• Iterates over user-permission tuples in the input relation to use as seeds for candidate rule generation.
• Computes user-attribute expressions (UAE) and resource-attribute expressions (RAE) to characterize user and resource sets.
• Generalizes initial candidate rules by replacing specific attribute values with constraints to cover more tuples.
• Applies rule merging and simplification to reduce redundancy and improve policy quality.
• Uses a weighted sum of rule components (WSC) as an objective function to guide selection of the highest-quality rules.
• Incorporates noise detection to identify inconsistencies in input data.

Experimental results

Research questions

• RQ1 Can ABAC policies be automatically mined from ACLs and attribute data with minimal manual effort?
• RQ2 How effective is the proposed algorithm in generating compact, accurate ABAC policies from legacy access control data?
• RQ3 To what extent can the algorithm generalize rules while maintaining coverage of all required user-permission mappings?
• RQ4 How does the algorithm handle noisy or inconsistent input data in real-world access control scenarios?
• RQ5 What is the trade-off between policy expressiveness and compactness in the mined ABAC policies?

Key findings

• The proposed ABAC policy mining algorithm is the first to address automated policy generation from ACLs and attribute data.
• The algorithm successfully generates ABAC policies that closely match original policies in synthetic and hand-written test cases.
• The algorithm demonstrates noise detection capability, identifying inconsistencies in input data.
• The algorithm reduces policy complexity through rule merging and simplification, improving manageability.
• The ABAC policy mining problem is proven to be NP-hard, establishing the computational difficulty of the problem.
• The algorithm uses a weighted sum of rule components (WSC) to guide policy selection, balancing coverage and compactness.