Strategies for Incorporating Delegation into Attribute-Based Access - - PowerPoint PPT Presentation

▶
strategies for incorporating delegation into attribute
SMART_READER_LITE
LIVE PREVIEW

Strategies for Incorporating Delegation into Attribute-Based Access - - PowerPoint PPT Presentation

Jun 20, 2023 297 likes •1.06k views

Strategies for Incorporating Delegation into Attribute-Based Access Control (ABAC) Sylvia L. Osborn Daniel Servos sylvia@csd.uwo.ca dservos5@uwo.ca Department of Computer Science The 9th International Symposium on Foundations & Practice

slide-1
SLIDE 1

Strategies for Incorporating Delegation into Attribute-Based Access Control (ABAC)

Daniel Servos dservos5@uwo.ca Sylvia L. Osborn sylvia@csd.uwo.ca The 9th International Symposium on Foundations & Practice of Security, October 2016

Department of Computer Science

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 1 / 22

slide-2
SLIDE 2

Talk Outline

1

Outline

2

Background

3

Strategies for Incorporating Delegation Attribute Delegation Group Membership Delegation Permission Delegation

4

Qualitative Evaluation

5

Conclusions and Future Work

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 2 / 22

slide-3
SLIDE 3

ABAC Background

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-4
SLIDE 4

ABAC Background

Role-Based Access Control (RBAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-5
SLIDE 5

ABAC Background

Role-Based Access Control (RBAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-6
SLIDE 6

ABAC Background

Role-Based Access Control (RBAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-7
SLIDE 7

ABAC Background

Attribute-Based Access Control (ABAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-8
SLIDE 8

ABAC Background

Attribute-Based Access Control (ABAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-9
SLIDE 9

ABAC Background

Attribute-Based Access Control (ABAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-10
SLIDE 10

ABAC Background

Attribute-Based Access Control (ABAC)

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 3 / 22

slide-11
SLIDE 11

Delegation

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 4 / 22

slide-12
SLIDE 12

Delegation

Key components of delegation: Delegators Delegatable Access Control Elements Delegatees

Delegator Delegatee Delegatable Elements Delegates

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 4 / 22

slide-13
SLIDE 13

Delegation Components

In RBAC: Delegators:

Users

Delegatable Access Control Elements:

Role Membership Permissions (via temporary role)

Delegatees:

Users User User Role Membership Delegates

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 4 / 22

slide-14
SLIDE 14

Delegation Components

In ABAC: Delegators: Delegatable Access Control Elements: Delegatees:

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 5 / 22

slide-15
SLIDE 15

Delegation Components

In ABAC: Delegators:

Users Groups

Delegatable Access Control Elements: Delegatees:

Users Groups

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 5 / 22

slide-16
SLIDE 16

Delegation Components

In ABAC: Delegators:

Users Groups

Delegatable Access Control Elements: Delegatees:

Users Groups Attributes Policies

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 5 / 22

slide-17
SLIDE 17

Delegation Components

In ABAC: Delegators:

Users Groups

Delegatable Access Control Elements:

Attributes Permissions Group Membership

Delegatees:

Users Groups Attributes Policies

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 5 / 22

slide-18
SLIDE 18

Strategy Graph

Users Groups Attributes Permissions Group Membership Users Groups Attributes Policies

Delegators Delegatees Delegated Element Delegates What Delegated To

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 6 / 22

slide-19
SLIDE 19

Strategy Graph

Users Groups Attributes Permissions Group Membership Users Groups Attributes Policies

Delegators Delegatees Delegated Element Delegates What Delegated To

User-to-User Permission Delegation

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 6 / 22

slide-20
SLIDE 20

Strategy Graph

Users Groups Attributes Permissions Group Membership Users Groups Attributes Policies

Delegators Delegatees Delegated Element Delegates What Delegated To

Group-to-Policy Attribute Delegation

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 6 / 22

slide-21
SLIDE 21

Delegation Strategies

Delegation Strategy Families

Strategy Name Delegator Delegated Element Delegatee Attribute Delegation User-to-User Attribute Delegation User Attribute Set User User-to-Group Attribute Delegation User Attribute Set Group Group-to-Group Attribute Delegation Group Attribute Set Group Group-to-User Attribute Delegation Group Attribute Set User User-to-Attribute Attribute Delegation User Attribute Set Attribute Group-to-Attribute Attribute Delegation Group Attribute Set Attribute User-to-Policy Attribute Delegation User Attribute Set Policy Group-to-Policy Attribute Delegation Group Attribute Set Policy Group Membership Delegation User-to-User Membership Delegation User Group Membership User Group-to-User Membership Delegation Group Group Membership User Group-to-Group Membership Delegation Group Group Membership Group User-to-Group Membership Delegation User Group Membership Group User-to-Attribute Membership Delegation User Group Membership Attribute Group-to-Attribute Membership Delegation Group Group Membership Attribute User-to-Policy Membership Delegation User Group Membership Policy Group-to-Policy Membership Delegation Group Group Membership Policy Permission Delegation User-to-User Permission Delegation User Permission Set User User-to-Group Permission Delegation User Permission Set Group Group-to-User Permission Delegation Group Permission Set User

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 7 / 22

slide-22
SLIDE 22

Delegation Strategies

Delegation Strategy Families

Strategy Name Delegator Delegated Element Delegatee Attribute Delegation User-to-User Attribute Delegation User Attribute Set User User-to-Group Attribute Delegation User Attribute Set Group Group-to-Group Attribute Delegation Group Attribute Set Group Group-to-User Attribute Delegation Group Attribute Set User User-to-Attribute Attribute Delegation User Attribute Set Attribute Group-to-Attribute Attribute Delegation Group Attribute Set Attribute User-to-Policy Attribute Delegation User Attribute Set Policy Group-to-Policy Attribute Delegation Group Attribute Set Policy Group Membership Delegation User-to-User Membership Delegation User Group Membership User Group-to-User Membership Delegation Group Group Membership User Group-to-Group Membership Delegation Group Group Membership Group User-to-Group Membership Delegation User Group Membership Group User-to-Attribute Membership Delegation User Group Membership Attribute Group-to-Attribute Membership Delegation Group Group Membership Attribute User-to-Policy Membership Delegation User Group Membership Policy Group-to-Policy Membership Delegation Group Group Membership Policy Permission Delegation User-to-User Permission Delegation User Permission Set User User-to-Group Permission Delegation User Permission Set Group Group-to-User Permission Delegation Group Permission Set User Group-to-Group Permission Delegation Group Permission Set Group User-to-Attribute Permission Delegation User Permission Set Attribute Group-to-Attribute Permission Delegation User Permission Set Attribute

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 7 / 22

slide-23
SLIDE 23

Delegation Strategies

Strategy Name Delegator Delegated Element Delegatee Attribute Delegation User-to-User Attribute Delegation User Attribute Set User User-to-Group Attribute Delegation User Attribute Set Group Group-to-Group Attribute Delegation Group Attribute Set Group Group-to-User Attribute Delegation Group Attribute Set User User-to-Attribute Attribute Delegation User Attribute Set Attribute Group-to-Attribute Attribute Delegation Group Attribute Set Attribute User-to-Policy Attribute Delegation User Attribute Set Policy Group-to-Policy Attribute Delegation Group Attribute Set Policy Group Membership Delegation User-to-User Membership Delegation User Group Membership User Group-to-User Membership Delegation Group Group Membership User Group-to-Group Membership Delegation Group Group Membership Group User-to-Group Membership Delegation User Group Membership Group User-to-Attribute Membership Delegation User Group Membership Attribute Group-to-Attribute Membership Delegation Group Group Membership Attribute User-to-Policy Membership Delegation User Group Membership Policy Group-to-Policy Membership Delegation Group Group Membership Policy Permission Delegation User-to-User Permission Delegation User Permission Set User User-to-Group Permission Delegation User Permission Set Group Group-to-User Permission Delegation Group Permission Set User Group-to-Group Permission Delegation Group Permission Set Group User-to-Attribute Permission Delegation User Permission Set Attribute Group-to-Attribute Permission Delegation User Permission Set Attribute User-to-Policy Permission Delegation User Permission Set Policy Group-to-Policy Permission Delegation Group Permission Set Policy

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 7 / 22

slide-24
SLIDE 24

Delegation Strategies

User-to-User Attribute Delegation User Attribute Set User User-to-Group Attribute Delegation User Attribute Set Group Group-to-Group Attribute Delegation Group Attribute Set Group Group-to-User Attribute Delegation Group Attribute Set User User-to-Attribute Attribute Delegation User Attribute Set Attribute Group-to-Attribute Attribute Delegation Group Attribute Set Attribute User-to-Policy Attribute Delegation User Attribute Set Policy Group-to-Policy Attribute Delegation Group Attribute Set Policy Group Membership Delegation User-to-User Membership Delegation User Group Membership User Group-to-User Membership Delegation Group Group Membership User Group-to-Group Membership Delegation Group Group Membership Group User-to-Group Membership Delegation User Group Membership Group User-to-Attribute Membership Delegation User Group Membership Attribute Group-to-Attribute Membership Delegation Group Group Membership Attribute User-to-Policy Membership Delegation User Group Membership Policy Group-to-Policy Membership Delegation Group Group Membership Policy Permission Delegation User-to-User Permission Delegation User Permission Set User User-to-Group Permission Delegation User Permission Set Group Group-to-User Permission Delegation Group Permission Set User Group-to-Group Permission Delegation Group Permission Set Group User-to-Attribute Permission Delegation User Permission Set Attribute Group-to-Attribute Permission Delegation User Permission Set Attribute User-to-Policy Permission Delegation User Permission Set Policy Group-to-Policy Permission Delegation Group Permission Set Policy

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 7 / 22

slide-25
SLIDE 25

Attribute Delegation

Delegatees are delegated a subset of the delegator’s attribute set (chosen by the delegator). Delegated attributes are merged with the delegatee’s directly assigned attributes. Merged (effective) attribute set is treated as the delegatee’s set for the purposes of policy evaluation.

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 8 / 22

slide-26
SLIDE 26

Attribute Delegation: Examples

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Dave) = {(role, { ProspectiveStudent })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 9 / 22

slide-27
SLIDE 27

Attribute Delegation: Examples

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Dave) = {(role, { ProspectiveStudent })}

Example 1

Alice wants to delegate attributes to Dave such that he satisfies the policy:

role = “undergrad” AND year ≥ 2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 9 / 22

slide-28
SLIDE 28

Attribute Delegation: Examples

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} {(year, {4}), (role, { undergrad })} direct(Dave) = {(role, { ProspectiveStudent })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 9 / 22

slide-29
SLIDE 29

Attribute Delegation: Examples

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} {(year, {4}), (role, { undergrad })} direct(Dave) = {(role, { ProspectiveStudent })} effective(Dave) = {(role, { ProspectiveStudent , undergrad )}, (year, {4})}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 9 / 22

slide-30
SLIDE 30

Attribute Delegation: Examples

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} {(year, {4}), (role, { undergrad })} direct(Dave) = {(role, { ProspectiveStudent })} effective(Dave) = {(role, { ProspectiveStudent , undergrad )}, (year, {4})}

Example 1

Alice wants to delegate attributes to Dave such that he satisfies the policy:

role = “undergrad” AND year ≥ 2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 9 / 22

slide-31
SLIDE 31

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-32
SLIDE 32

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })}

Example 2

Alice wants to delegate attributes to Charlie such that he satisfies the policy:

role IN {“undergrad”, “grad”} AND department = “CompSci”

At the same time, Bob wants to delegate attributes to Charlie such that he satisfies the policy:

role = “faculty” AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-33
SLIDE 33

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} {(department, { CompSci })} {(role, { faculty })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-34
SLIDE 34

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} {(department, { CompSci })} {(role, { faculty })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-35
SLIDE 35

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} {(department, { CompSci })} {(role, { faculty })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })} effective(Charlie) = {(role, { grad , faculty }), (department, { SoftEng , CompSci })}

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-36
SLIDE 36

Attribute Delegation: Examples

Alice Bob Charlie

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} direct(Bob) = {(role, { faculty }), (department, { SoftEng })} {(department, { CompSci })} {(role, { faculty })} direct(Charlie) = {(role, { grad }), (department, { SoftEng })} effective(Charlie) = {(role, { grad , faculty }), (department, { SoftEng , CompSci })}

Example 2

Alice wants to delegate attributes to Charlie such that he satisfies the policy:

role IN {“undergrad”, “grad”} AND department = “CompSci”

At the same time, Bob wants to delegate attributes to Charlie such that he satisfies the policy:

role = “faculty” AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 10 / 22

slide-37
SLIDE 37

Attribute Delegation: Problems/Benefits

Advantages of Attribute Delegation: Simple, easy to implement Works in distributed/SSO systems No extra computations/considerations at PEP or PDP

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 11 / 22

slide-38
SLIDE 38

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation:

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-39
SLIDE 39

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-40
SLIDE 40

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} {(year, {4}), (role, { undergrad })} direct(Dave) = {(role, { ProspectiveStudent })} effective(Dave) = {(role, { ProspectiveStudent , undergrad )}, (year, {4})} Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-41
SLIDE 41

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations

Alice Dave

direct(Alice) = {(year, {4}), (role, { undergrad }), (department, { CompSci })} {(year, {4}), (role, { undergrad })} direct(Dave) = {(role, { ProspectiveStudent })} effective(Dave) = {(role, { ProspectiveStudent , undergrad )}, (year, {4})}

role = “ProspectiveStudent”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-42
SLIDE 42

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-43
SLIDE 43

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-44
SLIDE 44

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion

Oscar Mallory

direct(Oscar) = {(year, {4}), (department, { CompSci })} direct(Mallory) = {(year, {1}), (department, { SoftEng })}

Example 3

Oscar and Mallory want to collude to pass the policy:

year > 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-45
SLIDE 45

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion

Oscar Mallory

direct(Oscar) = {(year, {4}), (department, { CompSci })} direct(Mallory) = {(year, {1}), (department, { SoftEng })} {(year, {4})}

Example 3

Oscar and Mallory want to collude to pass the policy:

year > 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-46
SLIDE 46

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion

Oscar Mallory

direct(Oscar) = {(year, {4}), (department, { CompSci })} direct(Mallory) = {(year, {1}), (department, { SoftEng })} effective(Mallory) = {(year, {1, 4}), (department, { SoftEng })} {(year, {4})}

Example 3

Oscar and Mallory want to collude to pass the policy:

year > 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-47
SLIDE 47

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion

Oscar Mallory

direct(Oscar) = {(year, {4}), (department, { CompSci })} direct(Mallory) = {(year, {1}), (department, { SoftEng })} effective(Mallory) = {(year, {1, 4}), (department, { SoftEng })} {(year, {4})}

Example 3

Oscar and Mallory want to collude to pass the policy:

year > 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-48
SLIDE 48

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion Effective attribute not descriptive of the delegatee

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-49
SLIDE 49

Attribute Delegation: Problems/Benefits

Issues with Attribute Delegation: Conflicting policy evaluations User collusion Effective attribute not descriptive of the delegatee User comprehension

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 12 / 22

slide-50
SLIDE 50

Group Membership Delegation

Requires an ABAC model like HGABAC or GURAG which supports user groups (in which members inherit attributes). Group membership is delegated, rather than individual or subsets of attributes. Delegatee’s effective attribute set is the combination of their directly assigned and inherited attributes (include those inherited from delegated memberships).

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 13 / 22

slide-51
SLIDE 51

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} direct(Bob) = {(year, {4})} direct(Dave) = {(year, {2})} Member

  • f

Member

  • f

Member

  • f

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-52
SLIDE 52

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} direct(Dave) = {(year, {2})} Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-53
SLIDE 53

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-54
SLIDE 54

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})}

Example 4

Bob wishes to delegate his membership in the SoftEng Undergrads group to Dave such that he can satisfy the policy:

year ≥ 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-55
SLIDE 55

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} Membership in SoftEng Group Delegates Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-56
SLIDE 56

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })} Membership in SoftEng Group Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-57
SLIDE 57

Group Membership Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })} Membership in SoftEng Group

Example 4

Bob wishes to delegate his membership in the SoftEng Undergrads group to Dave such that he can satisfy the policy:

year ≥ 2 AND department = “SoftEng”

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 14 / 22

slide-58
SLIDE 58

Group Membership Delegation: Problems/Benefits

Advantages of Group Membership Delegation: Easier to constrain User collusion is harder Attributes remain descriptive of delegatee Improved user comprehension Issues with Group Membership Delegation: Requires user group support Issues shared with Attribute Delegation:

Conflicting policy evaluations User collusion

Undelegatable Attributes

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 15 / 22

slide-59
SLIDE 59

Group Membership Delegation: Problems/Benefits

Advantages of Group Membership Delegation: Easier to constrain User collusion is harder Attributes remain descriptive of delegatee Improved user comprehension Issues with Group Membership Delegation: Requires user group support Issues shared with Attribute Delegation:

Conflicting policy evaluations User collusion

Undelegatable Attributes

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 15 / 22

slide-60
SLIDE 60

Group Membership Delegation: Problems/Benefits

Advantages of Group Membership Delegation: Easier to constrain User collusion is harder Attributes remain descriptive of delegatee Improved user comprehension Issues with Group Membership Delegation: Requires user group support Issues shared with Attribute Delegation:

Conflicting policy evaluations User collusion

Undelegatable Attributes

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 15 / 22

slide-61
SLIDE 61

Permission Delegation

Permissions obtained from satisfying a policy are delegated directly. Delegated permissions are valid so long as the policy is satisfied by the original delegator. When a group is acting as the delegator, delegatable permissions are the set of permissions a user would be granted if they had the same attribute set as assigned to the group.

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 16 / 22

slide-62
SLIDE 62

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })} Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-63
SLIDE 63

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })}

Example 5 role = “faculty” AND department = “CompSci” ⇒ p1 year ≥ 2 AND TIME > 9:00AM AND TIME < 5:00PM ⇒ p2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-64
SLIDE 64

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })}

P1, P2 P1 P2

Example 5 role = “faculty” AND department = “CompSci” ⇒ p1 year ≥ 2 AND TIME > 9:00AM AND TIME < 5:00PM ⇒ p2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-65
SLIDE 65

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })}

P1

Delegates

P1, P2 P1, P2 P1

Example 5 role = “faculty” AND department = “CompSci” ⇒ p1 year ≥ 2 AND TIME > 9:00AM AND TIME < 5:00PM ⇒ p2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-66
SLIDE 66

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })}

P1, P2 P2 P1

Example 5 role = “faculty” AND department = “CompSci” ⇒ p1 year ≥ 2 AND TIME > 9:00AM AND TIME < 5:00PM ⇒ p2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-67
SLIDE 67

Permission Delegation: Example

CS Faculty SoftEng Undergrads Alice Bob Dave

{(role, { faculty }), (department, { CompSci })} {(role, { undergrad }), (department, { SoftEng })} direct(Alice) = {} inherited(Alice) = {(role, { faculty }), (department, { CompSci })} effective(Alice) = {(role, { faculty }), (department, { CompSci })} direct(Bob) = {(year, {4})} inherited(Bob) = {(role, { faculty , undergrad }), (department, { CompSci , SoftEng })} effective(Bob) = {(yaer, {4}), (role, { faculty , undergrad }), (department, { CompSci , SoftEng })} direct(Dave) = {(year, {2})} inherited(Dave) = {(role, { undergrad }), (department, { SoftEng })} effective(Dave) = {(year, {2}), (role, { undergrad }), (department, { SoftEng })}

P2

Delegates

P1, P2 P2 P1, P2

Example 5 role = “faculty” AND department = “CompSci” ⇒ p1 year ≥ 2 AND TIME > 9:00AM AND TIME < 5:00PM ⇒ p2

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 17 / 22

slide-68
SLIDE 68

Permission Delegation: Problems/Benefits

Advantages of Permission Delegation: No changes to delegatee’s attribute set No conflicting policy evaluations No user collusion Improved user comprehension Issues with Permission Delegation: Implementation complexity Persistent evaluation of policies required

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 18 / 22

slide-69
SLIDE 69

Permission Delegation: Problems/Benefits

Advantages of Permission Delegation: No changes to delegatee’s attribute set No conflicting policy evaluations No user collusion Improved user comprehension Issues with Permission Delegation: Implementation complexity Persistent evaluation of policies required

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 18 / 22

slide-70
SLIDE 70

Qualitative Evaluation/Comparison

Informal evaluation based on following qualitative attributes: Required Features User Comprehension Attributes Remain Descriptive of Subject Potential for Conflicting Policy Evaluations Persistent Evaluation of Policies Required Implementation Complexity

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 19 / 22

slide-71
SLIDE 71

Qualitative Evaluation/Comparison: Results

Strategy Requires Features User Comprehension Attributes Remain Descriptive Conflicting Policy Evalua- tions Persistent Evaluation Required Attribute Delegation User-to-User Core ABAC Low No Yes No User-to-Group Core ABAC Low No Yes No Group-to-Group Core ABAC, User Groups Low Depends on Group Yes No Group-to-User Core ABAC, User Groups Low Depends on Group Yes No User-to-Attribute Core ABAC Low No Yes No Group-to-Attribute Core ABAC, User Groups Low Depends on Group Yes No User-to-Policy Core ABAC Very Low No Yes Yes Group-to-Policy Core ABAC, User Groups Very Low Depends on Group Yes Yes Group Membership Delegation User-to-User Core ABAC, User Groups Medium Depends on Group Yes No Group-to-User Core ABAC, User Groups Medium Depends on Group Yes No Group-to-Group Core ABAC, User Groups Medium Depends on Group Yes No User-to-Group Core ABAC, User Groups Medium Depends on Group Yes No User-to-Attribute Core ABAC, User Groups Medium Depends on Group Yes No Group-to-Attribute Core ABAC, User Groups Medium Depends on Group Yes No User-to-Policy Core ABAC, User Groups Low to Medium Depends on Group Yes Yes Group-to-Policy Core ABAC, User Groups Low to Medium Depends on Group Yes Yes Permission Delegation User-to-User Core ABAC High Yes No Yes User-to-Group Core ABAC High Yes No Yes Group-to-User Core ABAC, User Groups High Yes No Yes Group-to-Group Core ABAC, User Groups High Yes No Yes User-to-Attribute Core ABAC High Yes No Yes Group-to-Attribute Core ABAC, User Groups High Yes No Yes User-to-Policy Core ABAC Medium to High Yes No Yes Group-to-Policy Core ABAC, User Groups Medium to High Yes No Yes

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 20 / 22

slide-72
SLIDE 72

Conclusions

The ideal strategy largely depends on the needs and requirements of the implementing system. In general:

Permission Delegation strategies are ideal for systems requiring high user comprehension, removing conflicting policy evaluations and user collusion. Attribute Delegation strategies are ideal when it is not possible to continually evaluate policies or low implementation complexity is desired. Group Membership Delegation strategies provide higher user comprehension with similar results to Attribute Delegation but require user group support.

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 21 / 22

slide-73
SLIDE 73

Future Work

Using multiple strategies simultaneously could provide new possibilities for delegation. Existing policy conflict resolution techniques could help mitigate the issues faced by Attribute and Group Membership Delegation. Formalizing the strategies described in this work will allow for in-depth analysis and aid integration into existing ABAC models. Extending an existing model with each strategy would allow for a more quantitative evaluation and provide a reference model for future work. Revocation?, Multi-level delegation?, Monotonicity?, Totality?, etc.

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 22 / 22

slide-74
SLIDE 74

Future Work

Using multiple strategies simultaneously could provide new possibilities for delegation. Existing policy conflict resolution techniques could help mitigate the issues faced by Attribute and Group Membership Delegation. Formalizing the strategies described in this work will allow for in-depth analysis and aid integration into existing ABAC models. Extending an existing model with each strategy would allow for a more quantitative evaluation and provide a reference model for future work. Revocation?, Multi-level delegation?, Monotonicity?, Totality?, etc.

Daniel Servos & Sylvia L. Osborn Delegation Strategies for ABAC FPS’2016 22 / 22

slide-75
SLIDE 75