TY - GEN
T1 - A decision tree learning approach for mining relationship-based access control policies
AU - Bui, Thang
AU - Stoller, Scott D.
N1 - Publisher Copyright:
© 2020 ACM.
PY - 2020/6/10
Y1 - 2020/6/10
N2 - Relationship-based access control (ReBAC) provides a high level of expressiveness and flexibility that promotes security and information sharing, by allowing policies to be expressed in terms of chains of relationships between entities. ReBAC policy mining algorithms have the potential to significantly reduce the cost of migration from legacy access control systems to ReBAC, by partially automating the development of a ReBAC policy. This paper presents new algorithms, called DTRM (Decision Tree ReBAC Miner) and DTRM-, based on decision trees, for mining ReBAC policies from access control lists (ACLs) and information about entities. Compared to state-of-the-art ReBAC mining algorithms, our algorithms are significantly faster, achieve comparable policy quality, and can mine policies in a richer language.
AB - Relationship-based access control (ReBAC) provides a high level of expressiveness and flexibility that promotes security and information sharing, by allowing policies to be expressed in terms of chains of relationships between entities. ReBAC policy mining algorithms have the potential to significantly reduce the cost of migration from legacy access control systems to ReBAC, by partially automating the development of a ReBAC policy. This paper presents new algorithms, called DTRM (Decision Tree ReBAC Miner) and DTRM-, based on decision trees, for mining ReBAC policies from access control lists (ACLs) and information about entities. Compared to state-of-the-art ReBAC mining algorithms, our algorithms are significantly faster, achieve comparable policy quality, and can mine policies in a richer language.
KW - Attribute-based access control
KW - Decision trees
KW - Relationship-based access control
KW - Security policy mining
UR - https://www.scopus.com/pages/publications/85086824385
U2 - 10.1145/3381991.3395619
DO - 10.1145/3381991.3395619
M3 - Conference contribution
AN - SCOPUS:85086824385
T3 - Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT
SP - 167
EP - 178
BT - SACMAT 2020 - Proceedings of the 25th ACM Symposium on Access Control Models and Technologies
PB - Association for Computing Machinery
T2 - 25th ACM Symposium on Access Control Models and Technologies, SACMAT 2020
Y2 - 10 June 2020 through 12 June 2020
ER -