Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (2024)

Table of Contents
New Citation Alert added! New Citation Alert! MIST '16: Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats ABSTRACT References Cited By Index Terms Recommendations Login options Full Access Published in Sponsors In-Cooperation Publisher Publication History Permissions Check for updates Author Tags Qualifiers Conference Acceptance Rates Upcoming Conference Funding Sources Other Metrics Article Metrics Other Metrics Cited By PDF Format eReader Digital Edition Caption Export Citations

Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (2)

Advanced Search

ccs

research-article

  • Authors:
  • Peter Mell National Institute of Standards and Technology, Gaithersburg, MD, USA

    National Institute of Standards and Technology, Gaithersburg, MD, USA

    View Profile

    ,
  • James M. Shook National Institute of Standards and Technology, Gaithersburg, MD, USA

    National Institute of Standards and Technology, Gaithersburg, MD, USA

    View Profile

    ,
  • Serban Gavrila National Institute of Standards and Technology, Gaithersburg, MD, USA

    National Institute of Standards and Technology, Gaithersburg, MD, USA

    View Profile

MIST '16: Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security ThreatsOctober 2016Pages 13–22https://doi.org/10.1145/2995959.2995961

Published:28 October 2016Publication HistoryRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (3)

  • 9citation
  • 261
  • Downloads

Metrics

Total Citations9Total Downloads261

Last 12 Months23

Last 6 weeks1

  • Get Access

MIST '16: Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats

Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems

Pages 13–22

PreviousChapterNextChapter

Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (5)

ABSTRACT

The American National Standards Institute (ANSI) has standardized an access control approach, Next Generation Access Control (NGAC), that enables simultaneous instantiation of multiple access control policies. For large complex enterprises this is critical to limiting the authorized access of insiders. However, the specifications describe the required access control capabilities but not the related algorithms. While appropriate, this leave open the important question as to whether or not NGAC is scalable. Existing cubic reference implementations indicate that it does not. For example, the primary NGAC reference implementation took several minutes to simply display the set of files accessible to a user on a moderately sized system. To solve this problem we provide an efficient access control decision algorithm, reducing the overall complexity from cubic to linear. Our other major contribution is to provide a novel mechanism for administrators and users to review allowed access rights. We provide an interface that appears to be a simple file directory hierarchy but in reality is an automatically generated structure abstracted from the underlying access control graph that works with any set of simultaneously instantiated access control policies. Our work thus provides the first efficient implementation of NGAC while enabling user privilege review through a novel visualization approach. These capabilities help limit insider access to information (and thereby limit information leakage) by enabling the efficient simultaneous instantiation of multiple access control policies.

References

  1. ANSI. American national standard for information technology, role-based access control (RBAC), 2004.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (6)
  2. ANSI. American national standard for information technology - next generation access control - functional architecture (NGAC-FA), 2013.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (7)
  3. ANSI. American national standard for information technology - next generation access control - generic operations and data structures (NGAC-GOADS), 2016.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (8)
  4. K. Belyaev. tinyPM Prototype. www.github.com/kirillbelyaev/tinypm, 2015.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (9)
  5. P. Biswas, R. Sandhu, and R. Krishnan. Label-based access control: An ABAC model with enumerated authorization policy. In Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control, ABAC '16, pages 1--12, New York, NY, USA, 2016. ACM. Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (10)Digital Library
  6. B. Bollobas. Random graphs. Cambridge studies in advanced mathematics. Cambridge university press, Cambridge, New York (N. Y.), Melbourne, 2001.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (12)
  7. D. F. Brewer and M. J. Nash. The chinese wall security policy. In Security and Privacy, 1989. Proceedings., 1989 IEEE Symposium on, pages 206--214. IEEE, 1989.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (13)Cross Ref
  8. D. Ferraiolo, V. Atluri, and S. Gavrila. The policy machine: A novel architecture and framework for access control policy specification and enforcement. Journal of Systems Architecture, 57(4):412--424, 2011. Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (15)Digital Library
  9. D. Ferraiolo, S. Gavrila, and W. Jansen. Policy machine: Features, architecture, and specification. Technical Report NISTIR 7987 Revision 1, National Institute of Standards and Technology, Oct. 2015.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (17)Cross Ref
  10. GitHub. Github code repository. www.github.com, 2016.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (19)
  11. X. Jin, R. Krishnan, and R. Sandhu. A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC, pages 41--55. Springer Berlin Heidelberg, Berlin, Heidelberg, 2012. Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (20)Digital Library
  12. Medidata Solutions Worldwide. Medidata Policy Machine code on github, version 1.1.0., www.github.com/mdsol/the_policy_machine, 2016.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (22)
  13. NCSC. A Guide to Understanding Discretionary Access Control in Trusted Systems. Number NCSC-TG-003. National Computer Security Center, Fort George G. Meade, Maryland, USA, 1 edition, Sept. 1987.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (23)
  14. NIST. NIST Policy Machine code on github, version 1.5., www.github.com/PM-Master/PM, 2016.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (24)
  15. OASIS. eXtensible access control markup language (XACML) Version 3.0., OASIS Standard, Jan. 2013.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (25)
  16. Organization for the advancement of structured information standards OASIS. www.oasis-open.org, 2016.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (26)
  17. D. Servos and S. L. Osborn. HGABAC: Towards a Formal Model of Hierarchical Attribute-Based Access Control, pages 187--204. Springer International Publishing, Cham, 2015.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (27)
  18. F. Turkmen and B. Crispo. Performance evaluation of XACML PDP implementations. In Proceedings of the 2008 ACM Workshop on Secure Web Services, SWS '08, pages 37--44, New York, NY, USA, 2008. ACM. Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (28)Digital Library
  19. U.S. Department of Defense. Trusted computer system evaluation criteria DoD 5200.28-STD, 1985.Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (30)
  20. E. Yuan and J. Tong. Attributed based access control (ABAC) for web services. In IEEE International Conference on Web Services (ICWS'05), page 569, July 2005. Google ScholarRestricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (31)Digital Library

Cited By

View all

Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (33)

    Index Terms

    1. Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems

      1. Security and privacy

        1. Security services

          1. Access control

      Recommendations

      • A System for Centralized ABAC Policy Administration and Local ABAC Policy Decision and Enforcement in Host Systems using Access Control Lists

        ABAC'18: Proceedings of the Third ACM Workshop on Attribute-Based Access Control

        We describe a method that centrally manages Attribute-Based Access Control (ABAC) policies and locally computes and enforces decisions regarding those policies for protection of resource repositories in host systems using their native Access Control ...

        Read More

      • Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC)

        ABAC '16: Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control

        Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) are very different attribute based access control standards with similar goals and objectives. An objective of both is to provide a standardized way for ...

        Read More

      • Imposing Fine-grain Next Generation Access Control over Database Queries

        ABAC '17: Proceedings of the 2nd ACM Workshop on Attribute-Based Access Control

        In this paper, we describe a system that leverages ANSI/INCITS Next Generation Access Control (NGAC) standard called Next-generation Database Access Control (NDAC) for accessing data in tables, rows, and columns in existing RDBMS products. NDAC imposes ...

        Read More

      Login options

      Check if you have access through your login credentials or your institution to get full access on this article.

      Sign in

      Full Access

      Get this Publication

      • Information
      • Contributors

      • Published in

        Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (34)

        MIST '16: Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats

        October 2016

        126 pages

        ISBN:9781450345712

        DOI:10.1145/2995959

        • General Chairs:
        • Ilsun You

          Soonchunhyang University, Republic of Korea

          ,
        • Elisa Bertino

          Purdue University, USA

        Copyright © 2016 Public Domain

        This paper is authored by an employee(s) of the United States Government and is in the public domain. Non-exclusive copying or redistribution is allowed, provided that the article citation is given and the authors and agency are clearly identified as its source.

        Sponsors

          In-Cooperation

            Publisher

            Association for Computing Machinery

            New York, NY, United States

            Publication History

            • Published: 28 October 2016

            Permissions

            Request permissions about this article.

            Request Permissions

            Check for updates

            Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (37)

            Author Tags

            • ABAC
            • NGAC
            • NIST
            • XACML
            • access control
            • algorithms
            • complexity
            • computer security
            • graph theory
            • insider
            • policy machine
            • simultaneous instantiation

            Qualifiers

            • research-article

            Conference

            Acceptance Rates

            MIST '16 Paper Acceptance Rate8of22submissions,36%Overall Acceptance Rate21of54submissions,39%

            More

            Upcoming Conference

            CCS '24

            • Sponsor:
            • sigsac

            ACM SIGSAC Conference on Computer and Communications Security

            October 14 - 18, 2024

            Salt Lake City , UT , USA

            Funding Sources

            • Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (38)

              Other Metrics

              View Article Metrics

            • Bibliometrics
            • Citations9

            • Article Metrics

              • 9

                Total Citations

                View Citations

              • 261

                Total Downloads

              • Downloads (Last 12 months)23
              • Downloads (Last 6 weeks)1

              Other Metrics

              View Author Metrics

            • Cited By

              View all

              PDF Format

              View or Download as a PDF file.

              PDF

              eReader

              View online with eReader.

              eReader

              Digital Edition

              View this article in digital edition.

              View Digital Edition

              • Figures
              • Other

                Close Figure Viewer

                Browse AllReturn

                Caption

                View Table of Contents

                Export Citations

                  Your Search Results Download Request

                  We are preparing your search results for download ...

                  We will inform you here when the file is ready.

                  Download now!

                  Your Search Results Download Request

                  Your file of search results citations is now ready.

                  Download now!

                  Your Search Results Download Request

                  Your search export query has expired. Please try again.

                  Restricting Insider Access Through Efficient Implementation of Multi-Policy Access Control Systems | Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats (2024)
                  Top Articles
                  8 Superior Hello Kitty Phone Case For 2023 | CellularNews
                  Apple iPhone 13 kaufen: Wo Smartphone-Rabatte von fast 100 Euro winken
                  Seattle Public Schools School District Homes for Sale & Real Estate, Seattle, WA | RE/MAX
                  Keith Streckenbach on LinkedIn: How Compounding360 Streamlines Compounding Compliance
                  Latest Posts
                  iPhone 13 - Specificaties
                  Master iOS 14 Home Screen app management on iPhone - 9to5Mac
                  Article information

                  Author: Kimberely Baumbach CPA

                  Last Updated:

                  Views: 6346

                  Rating: 4 / 5 (41 voted)

                  Reviews: 88% of readers found this page helpful

                  Author information

                  Name: Kimberely Baumbach CPA

                  Birthday: 1996-01-14

                  Address: 8381 Boyce Course, Imeldachester, ND 74681

                  Phone: +3571286597580

                  Job: Product Banking Analyst

                  Hobby: Cosplaying, Inline skating, Amateur radio, Baton twirling, Mountaineering, Flying, Archery

                  Introduction: My name is Kimberely Baumbach CPA, I am a gorgeous, bright, charming, encouraging, zealous, lively, good person who loves writing and wants to share my knowledge and understanding with you.