Fast Distributed Evaluation of Stateful Attribute-Based Access Control Policies

Separation of access control logic from other components of applications facilitates uniform enforcement of policies across applications in enterprise systems. This approach is popular in attribute-based access control (ABAC) systems and is embodied in the XACML standard. For this approach to be practical in an enterprise system, the access control decision engine must be scalable, able to quickly respond to access control requests from many concurrently running applications. This is especially challenging for stateful (also called history-based) access control policies, in which access control requests may trigger state updates. This paper presents an policy evaluation algorithm for stateful ABAC policies that achieves high throughput by distributed processing, using a specialized multi-version concurrency control scheme to deal with possibly conflicting concurrent updates. The algorithm is especially designed to achieve low latency, by minimizing the number of messages on the critical path of each access control decision.

[1]  Song Zhi-gang.  Role Based Access Control in MIS , 2002 .

[2]  David W. Chadwick.  Coordinated decision making in distributed applications , 2007, Inf. Secur. Tech. Rep..

[3]  Wouter Joosen,et al.  Scalable and Secure Concurrent Evaluation of History-based Access Control Policies , 2015, ACSAC 2015.

[4]  Wilson C. Hsieh,et al.  Bigtable: A Distributed Storage System for Structured Data , 2006, TOCS.

[5]  Anil Nerode,et al.  Evaluating distributed xacml policies , 2007, SWS '07.

[6]  Jaehong Park,et al.  The UCONABC usage control model , 2004, TSEC.

[7]  Jaehong Park,et al.  A provenance-based access control model for dynamic separation of duties , 2013, 2013 Eleventh Annual Conference on Privacy, Security and Trust.

[8]  Abraham Silberschatz,et al.  Database System Concepts , 1980 .

[9]  Heiko Mantel,et al.  Service Automata , 2011, Formal Aspects in Security and Trust.

[10]  Helge Janicke,et al.  Decentralized XACML Overlay Network , 2010, 2010 10th IEEE International Conference on Computer and Information Technology.

[11]  Alexander Pretschner,et al.  A Fully Decentralized Data Usage Control Enforcement Infrastructure , 2015, ACNS.

[12]  Jorge Lobo,et al.  Refinement of History-Based Policies , 2011, Logic Programming, Knowledge Representation, and Nonmonotonic Reasoning.

[13]  Fabio Martinelli,et al.  Enforcement of U-XACML History-Based Usage Control Policy , 2016, STM.

[14]  E. F. Michiels,et al.  ISO/IEC 10181-4:1995 Information technology Open Systems Interconnection Security frameworks for open systems: Non-repudiation framework , 1996 .

[15]  Sebastian Nanz,et al.  A logic for state-modifying authorization policies , 2007, TSEC.

[16]  Michael J. Nash,et al.  The Chinese Wall security policy , 1989, Proceedings. 1989 IEEE Symposium on Security and Privacy.

[17]  Yanhong A. Liu,et al.  From Clarity to Efficiency for Distributed Algorithms , 2014, ACM Trans. Program. Lang. Syst..

[18]  Vipin Chaudhary,et al.  History-based access control for mobile code , 1998, CCS '98.

[19]  Carlos Ribeiro,et al.  A scalable history-based policy engine , 2006, Seventh IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY'06).

[20]  Moritz Y. Becker.  Specification and Analysis of Dynamic Authorisation Policies , 2009, 2009 22nd IEEE Computer Security Foundations Symposium.

[21]  Yanhong A. Liu,et al.  From Clarity to E iciency for Distributed Algorithms , 2017 .

[22]  Annette Bieniusa,et al.  Access Control for Weakly Consistent Replicated Information Systems , 2016, STM.