Access Control with Trust and Machine Learning

NISNet PhD student workshop, Bergen, Norway01-03 September 2010

Access Control with Trust and Machine Learning

Sergiy Gladysh

NTNU, ITEM

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

2Access Control: General Model

Requests

Access Control Policy

(PDP – Policy Decision Point)

O11

Audit Log

Information Security Boundary

O12 O13

Objects

O21 O22 O23

B

A

C

Reference Monitor

(PEP – Policy Enforcement Point)

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

3Discretionary Access Control (DAC)

O11

D

O12

O13

O14

C

A

B

...

Users

Authorization

Reference Monitor

Access Matrix

ACL1:A: r, wB: rC: r:

O1 O2 O3 ...A: r,w r -B: r r rwC: r: r r

O21

O22

O23

O24

ACL2:A: rB: r, wC: r, w

ObjectsInformation Security Boundary

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

4Mandatory Access Control (MAC)

O11

D

O12

O13

O14

Users

O21

O22

O23

O24

Objects

Information Security Boundary

Confidentiality Label 2

Access Level 1

Access Level 2

Access Level 3

Access Level 4

C

B

A

Confidentiality Label 2

Top Secret

Secret

Confidential

Unclassified

Reference Monitor

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

5

Role-Based Access Control (RBAC)

P11

D

P12

P13

C

A

B

Role1

...

Users

Permissions

User-Role Assignment

Role2

Roles

O11

O12

O13

O14

Objects

P21

P22

P23

Permissions

O21

O22

O23

O24

Objects

Se

ssio

ns

Se

ssio

ns

Role Activation

(UA) (RA)

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

6

Context-Aware RBAC, Dynamic Constraints, ABAC

P11

D

P12

P13

C

A

B

Role1...

Users RA Constraints: - Location;- Temporal

PermissionsUser-Role Assignment

Role2

Roles

O11

O12

O13

O14

Objects

P21

P22

P23

Permissions

O21

O22

O23

O24

Objects

Se

ssio

ns

Ses

sio

ns

Role Activation

(UA) (RA)

UA Constraints: - Separation of Duties (SoD);- Attributes (ABAC, XACML)

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

7Problems in Open Environments

Requests

Access Control Policy

(PDP – Policy Decision Point)

O11

Audit Log

Information Security Boundary

O12 O13

Objects

O21 O22 O23

B

A

C

Reference Monitor(PEP – Policy

Enforcement Point)

X... ZW

?

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

8

Trust Network Analysis + Machine Learning

ωEA

ωEB

ωEC

X

E

C

B

A

Trust Metrics - Beta Probability Density Funtions

Problem in Open Environment: New/Unknown User

Trust Network

?

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

9

Trust Network Analysis + Machine Learning

ωEA

ωEB

ωEC

ωCX

X

E

C

B

A

Trust Metrics - Beta Probability Density Funtions

Lookup: Graph Query >> Indirect Trust Edge

Trust Network

?

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

10

Trust Network Analysis + Machine Learning

ωEA

ωEB

ωEC

ωCX

ωEC ωC

X

X

E

C

B

A

Trust Metrics - Beta Probability Density Funtions

Subjective Logic >> Probabilistic Inferrence of Metric for Indirect Trust

Trust Network

?

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

11

Trust Network Analysis + Machine Learning

ωEA

ωEB

ωEC

ωCXωE

C ωCX

X

E

C

B

A

Trust Metrics - Beta Probability Density Funtions

Subjective Logic >> Inferred Metric for Indirect Trust

Trust Network

:) !

Access Control with Trust and Machine LearningSergiy Gladysh, PhD researcher, NTNU

12

RBAC Dynamic Constraints + Trust Network

P11

D

P12

P13

C

A

B

Role1

...

Users RA Constraints: - Location;- Temporal

PermissionsUser-Role Assignment

Role2

Roles

O11

O12

O13

O14

Objects

P21

P22

P23

Permissions

O21

O22

O23

O24

ObjectsS

ess

ion

sS

ess

ions

Role Activation

(UA) (RA)

UA Constraints: - SoD; - ABAC; - Trust / Reputation

Trust Network

ωEA

ωEB

ωEC

ωCX

ωEC ωC

X

X

E

C

B

A