Upload File

1 attribute-based access control models and beyond prof. ravi sandhu executive director, institute...

  • Home
  • Documents
  • 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber
31
1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber Security University of Texas at San Antonio AsiaCCS Keynote Talk Singapore April 16, 2015 [email protected], www.profsandhu.com, www.ics.utsa.edu © Ravi Sandhu World-Leading Research with Real-World Impact!

Upload: theresa-singleton

Post on 18-Dec-2015

219 views

Category:

Documents


2 download

Report

Tags:

TRANSCRIPT

Page 1: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

1

Attribute-Based Access Control Modelsand Beyond

Prof. Ravi Sandhu

Executive Director, Institute for Cyber SecurityLutcher Brown Endowed Chair in Cyber Security

University of Texas at San Antonio

AsiaCCS Keynote TalkSingapore

April 16, 2015

[email protected], www.profsandhu.com, www.ics.utsa.edu

© Ravi Sandhu World-Leading Research with Real-World Impact!

Page 2: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 2World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

Page 3: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 3World-Leading Research with Real-World Impact!

PEI Models

Idealized

Enforceable(Approximate)

Codeable

Page 4: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 4World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

Page 5: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 5World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

Fixedpolicy

Flexiblepolicy

Page 6: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 6World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

EnterpriseOriented

BeyondEnterprise

Page 7: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 7World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

AdministrationDriven

AutomatedAdaptive

Page 8: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

8World-Leading Research with Real-World Impact!

RBAC96 Model

© Ravi Sandhu

Constraints

Page 9: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

Fundamental Theorem of RBAC

© Ravi Sandhu 9World-Leading Research with Real-World Impact!

RBAC can be configured to do MAC

RBAC can be configured to do DAC

RBAC is policy neutralRBAC is neither MAC nor DAC!

Page 10: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

10World-Leading Research with Real-World Impact!

RBAC Shortcomings

© Ravi Sandhu

Constraints

Hard Enough Impossible

Page 11: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 11World-Leading Research with Real-World Impact!

The RBAC Story

2nd expansion phase1st expansion phase

1995 2000 2005 2008

Amount ofPublications

Year of Publication

28 30 30 35 40 48 53 88 85 88 112 103 111 866

1992

3 2 7 3

80

60

40

20

0

Pre-RBAC Early RBAC

100

RBAC96model

NIST-ANSIStandard Proposed

NIST-ANSIStandardAdopted

Ludwig Fuchs, Gunther Pernul and Ravi Sandhu, Roles in Information Security-A Survey and Classification of the Research Area, Computers & Security, Volume 30, Number 8, Nov. 2011, pages 748-76

Page 12: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 12World-Leading Research with Real-World Impact!

ABAC Status

2nd expansion phase1st expansion phase

1995 2000 2005 2008

Amount ofPublications

Year of Publication

28 30 30 35 40 48 53 88 85 88 112 103 111 866

1992

3 2 7 3

80

60

40

20

0

Pre-RBAC Early RBAC

100

RBAC96paper

ProposedStandard

StandardAdopted

ABAC still in pre/early phase

1990? 2015

Page 13: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

13© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

User (Identity)

Attributes Public-keys + Secured secrets

Page 14: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

14© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

User (Identity)

Attributes Public-keys + Secured secrets

X.509Identity

Certificates

X.500Directory

Pre Internet, early 1990s

Page 15: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

15© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

User (Identity)

Attributes Public-keys + Secured secrets

X.509Identity

Certificates

X.509Attribute

Certificates

Post Internet, late 1990s

Page 16: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

16© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

User (Identity)

Attributes Public-keys + Secured secrets

Post Internet, late 1990s

SPKI Certificates

Page 17: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

17© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

User (Identity)

Attributes Public-keys + Secured secrets

Mature Internet, 2000s

AnonymousCredentials

Page 18: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

18© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

Action

User

Subject

Object

Context

Policy

Authorization Decision

Yes/No

Attributes

Mature Internet, 2000s

XACML

Page 19: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

19© Ravi Sandhu World-Leading Research with Real-World Impact!

ABAC is not New

Usage Control Models, early 2000s

Rights(R)

Authorizations

(A)

Subjects(S)

Objects(O)

Subject Attributes (SA) Object Attributes (OA)

Obligations(B)

Conditions(C)

UsageDecisions

before-usage ongoing-Usage after-usage

Continuity ofDecisions

pre-decision ongoing-decision

pre-update ongoing-update post-update

Mutability ofAttributes

• unified model integrating• authorization• obligation• conditions

• and incorporating• continuity of decisions• mutability of attributes

Page 20: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 20World-Leading Research with Real-World Impact!

ABAC Status

2nd expansion phase1st expansion phase

1995 2000 2005 2008

Amount ofPublications

Year of Publication

28 30 30 35 40 48 53 88 85 88 112 103 111 866

1992

3 2 7 3

80

60

40

20

0

Pre-RBAC Early RBAC

100

RBAC96paper

ProposedStandard

StandardAdopted

ABAC still in pre/early phase

1990? 2015

Page 21: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 21World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????

Page 22: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

22World-Leading Research with Real-World Impact!

ABACα Model Structure

© Ravi Sandhu

Policy Configuration Points

Can be configured to do simple forms of DAC, MAC, RBAC

Page 23: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

23World-Leading Research with Real-World Impact!

RBAC Extensions

3. Subject attributes constrained by attributes of subjects created by the same user.

5. Meta-Attributes

2. Subject attribute constraints policy are different at creation and modification time.

1. Context Attributes

4. Policy Language

1, 2, 4, 5

1, 4, 5

4, 5

1,41, 4, 5

1, 2, 3, 4, 5

4

Page 24: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

24

ABACβ Model

Can be configured to do many RBAC extensions

Page 25: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

25

SOME RESEARCH CHALLENGES

© Ravi Sandhu World-Leading Research with Real-World Impact!

Page 26: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

26© Ravi Sandhu World-Leading Research with Real-World Impact!

Ultimate Unified Model

SecurityAccess Control

TrustRisk

Attributes

Relationships Provenance

Page 27: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 27World-Leading Research with Real-World Impact!

Expressive Power

Idealized

Enforceable(Approximate)

Codeable

Page 28: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 28World-Leading Research with Real-World Impact!

Safety Analysis

Idealized

Enforceable(Approximate)

Codeable

Page 29: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

29

Attribute and Policy Engineering

Page 30: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

Application Domains

© Ravi Sandhu 30World-Leading Research with Real-World Impact!

Cloud computing Internet of Things ……….

Page 31: 1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber

© Ravi Sandhu 31World-Leading Research with Real-World Impact!

Access Control

Discretionary Access Control (DAC), 1970

Mandatory Access Control (MAC), 1970

Role Based Access Control (RBAC), 1995

Attribute Based Access Control (ABAC), ????


Protestant Minister Father: Mark Lutcher

INSTITUTE FOR CYBER SECURITY 1 Access Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at

1 Rethinking Password Strategies Ravi Sandhu Chief Scientist [email protected] 703 283 3484 [email protected]

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security

© 2004 Ravi Sandhu Cyber-Identity, Authority and Trust in an Uncertain World Prof. Ravi Sandhu Laboratory for Information Security Technology

© 2004-5 Ravi Sandhu Cyber-Identity, Authority and Trust in an Uncertain World Prof. Ravi Sandhu Laboratory for Information Security Technology

INSTITUTE FOR CYBER SECURITY 1 The PEI Framework for Application-Centric Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for

gagan sandhu

1 The Future of Cyber Security Prof. Ravi Sandhu Executive Director February 2010 [email protected] © Ravi Sandhu

Scada Hack sandhu

b Presentation Kamran Sandhu

Rethinking Password Strategies Ravi Sandhu Chief Scientist sandhu@nsdsecurity 703 283 3484

Service Tax_Shivpreet Singh Sandhu

Dr. Sandhu Career Investigation

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University

Kim sandhu

INSTITUTE FOR CYBER SECURITY © Ravi Sandhu11 Group-Centric Information Sharing Ravi Sandhu Executive Director and Endowed Professor Institute for Cyber

Institute for Cyber Security (ICS) Prof. Ravi Sandhu Executive Director and Lutcher Brown Endowed Chair [email protected] 210 458 6081

INSTITUTE FOR CYBER SECURITY April 20081 Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair

Cyber Security and Privacy: An Optimist’s Perspective · 2016-03-22 · 1 Cyber Security and Privacy: An Optimist’s Perspective Prof. Ravi Sandhu Executive Director, Institute

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security

Towards Secure Information Sharing Models for Community Cyber Security Ravi Sandhu, Ram Krishnan and Gregory B. White Institute for Cyber Security University

1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015 [email protected]

INSTITUTE FOR CYBER SECURITY 1 A Perspective on Usage Control and its Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber

JASDEV SINGH SANDHU - Jssgoi · JASDEV SINGH SANDHU Foundation Jasdev Singh Sandhu Group of Institutes promoted and run under the JASDEV SINGH SANDHU FOUNDATION promoted/established

1 Future of Access Control: Attributes, Automation, Adaptation Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed

2016 05 02 o m SANDHU ,GURBIR SINGH SANDHU, AG HRY ,SS KHARAB IN CRA-D-861-DB-2012 SIDAKMEET SANDHU ,AG HARYANA ,GURBIR SINGH SANDHU ,VIKRAM ANAND, MANPREET SINGH 213 I CRM-28153

Towards A Framework for Cyber Social Status Based Trusted Open Collaboration Oct. 9, 2010 Jaehong Park, Yuan Cheng, Ravi Sandhu Institute for Cyber Security

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: What You Need to Know Prof. Ravi Sandhu Executive Director and Chief Scientist Institute for Cyber Security

1 Cyber Security Research: A Personal Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair January 18, 2013 [email protected]

1 Laws of Cyber Security Ravi Sandhu Executive Director and Endowed Professor September 2010 [email protected], ,

1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber

1 Speculations on the Future of Cyber Security in 2025 Prof. Ravi Sandhu Executive Director January 2010 [email protected]