Scalable and Efficient Reasoning for Enforcing Role-Based Access Control

1. Scalable and Efficient Reasoning for Enforcing Role-Based Access Control Tyrone Cadenhead Murat Kantarcioglu, and Bhavani Thuraisingham

2. Overview • Motivation • Contributions • Approach • Theoretical Background: • RBAC, TRBAC, Description Logics, SWRL • Detailed Overview of Approach and Optimizations • Example • Experimental Results

3. Motivation • Organizations tend to generate large amount of data (or resources) • Users need only partial access to resources • Pairs: (user, role) (role, permission) (action, resource) • nu users and nr roles  at most nu ×nr mappings • Scalable access control model • Exchange expertise among experts, between systems • Heterogeneity in system • Make decision with data • Formal Semantics of Data

4. Motivation (cont’d) • RBAC simplifies Security Management • But Roles are statically defined • TRBAC extends RBAC • Roles are dynamically defined and have a temporal dimension • Does not address Heterogeneity inherent in organization information systems • Ontology has a Common Vocabulary • Conforms to a Description Logic (DL) formalism • Description Logic (DL) Reasoning Service • Can be Distributed as over a set of Knowledge Bases

5. Why Flexible RBAC • Physician Sam allowed access to Bob record • When Bob is under is care • Emergency: Sam is off duty, Kelly in emergency room: • Bob needs immediate treatment • Kelly not pre-assigned to view/update Bob’s record • Temporal RBAC

6. Why Flexible TRBAC • Kelly needs to collaborate with different specialist from different expertise • Sharing of data across wards, departments • Seamless and unambiguous exchange of information • Ontologies • Common Vocabulary • Enable reconciliation and translation between different standards

7. Automation • Kelly and team make decisions • Using Bob medical history • Access is needed Temporarily • Accuracy and efficiency critical • Automated Tool • Access granted in Emergency session • Apply policy rules over relevant data in Bob’s record • Verify the decisions based on formal logic • Make access decisions efficiently

8. Main Contributions • TRBAC Implementation using existing semantic technologies • Reasoning Service for access control over large numbers of data instances in DL Knowledge Bases (KBs) • Efficiently and accurately reason about access rights

9. Approach • Transform temporal access control policies to rules : • Semantic web rule language (SWRL) • Partitioning the Knowledge Base (KB) • - Terminological Box (TBox) • - Assertional Box (ABox) • A Knowledge Base consists of a TBox and ABox

10. Approach (cont’d) • Achieves: 1. Scalability – support many users, roles, sessions, permissions; combinations w.r.t access control policies 2. Efficiency - determines the response time to make a decision in milliseconds 3. Correct reasoning – ensure all data assertions available when applying the security policies

11. Theoretical Background • RBAC • TRBAC • Description Logic Language (ALCQ) • SWRL

12. RBAC

13. (Mappings) • Connect individuals from two domain modules: • RBAC assignments: • Think of mappings as relations of form P(i, j) with valid pairs (i, j) user-role, role-user, role-permission, permission-role, session-user, role-role and session-role • a binary relationship of form P(x, y), a restriction on values assigned to (x, y) pairs • Hospital extensions: • the mappings patient-user, user-patient and patient-session • Patient-Record constraint: • the one-to-one mappings patient-record and record-patient

14. TRBAC • Extension of RBAC • Supports temporal access • Expressed by means of role triggers • Constrains the set of roles that a particular user can activate at a given time instant • Triggers • Firing a trigger cause a role to be enabled/disabled • Conflict Resolution • Simultaneous enabling and disabling of a role • Priorities

15. Description Logics • Formally build our domain concepts and the relationships between them. • Add semantics (reasoning) • Use a knowledge representation language • We can formally say a doctor is a user, a surgeon is a doctor, a doctor has a medical degree.

16. Description Logics

17. SWRL Semantic Web Rule language (SWRL) • W3C recommendation. • A SWRL rule has the form: hi, bj are atoms of the form C(x), P(x, y) , sameAs(x,y), or differentFrom(x,y), where C is an OWL description, P is an OWL property, and x, y are Datalog variables, OWL individuals, or OWL data values

18. Overview

19. Intuition • a user assigned to role : • User attributes (name, sex, id) in partition • Details relating to role in partition • Session related details in partition • Query : • Optimization:

20. Step 1 • Build step offline • Restrict each partition size: ensures each KB fits into the memory on the machine

21. Step 2 • Load the policy rules into a new knowledge base . • Rules determine which assertions are relevant to determine any policy objective. • Adding rules to more efficient • Experimental results: • Impact on the reasoning time vs. adding rules to • Rules apply to a small subset of triples • Reduced number of symbols in the ABox

22. Step 3 RBAC:

23. Inference Stage • When there is an access request for a specific patient, start executing steps 2 and 3. • Steps 2 and 3 are our inferencing stages where we enforce the security policies. • These can also be executed concurrently for many patients, as desired.

24. TBox • RBAC: • The sets and are atomic concepts in • Mappings and are formalized as DL roles • Employees are Users • Primary Physicians are employees with at least one patient • We can Conclude primary physicians are users.

25. ABox

26. RDF • W3C recommendation • Make assertions about any resources on the semantic Web • We can say Bob is a doctor • Doctor(Bob)  (Bob rdf:type Doctor) • Bob attended Harvard • (Bob, attended, “Harvard”)

27. Distributed Reasoning

28. Home Partition

29. Connecting Partitions

30. Distributed Reasoning • Physicians can be both a primary or emergency-room physician, and restricted to two roles. • Verify Bob does not exceed two roles • Execute query over is sufficient • Primary Physicians attend to at most five patients at a time • Query each one at a time is sufficient

31. Temporal RBAC Reasoning • Implement TRBAC as triggers • TBox • ABox

32. Temporal RBAC Reasoning • Periodic Event • Trigger: • doctor-on-day-duty must be enabled during the night • nurse-on-night-duty must be enabled whenever the role doctor-on-night-duty is

33. Advantages

34. Optimization • Two types of indexing: • indexing the assertions • Allow finding triple by subject (s), a predicate (p) or an object (o), • without the cost of a linear search over all the triples in a partition • creating a high level index. • points to the location of the partitions on disk • At most linear with respect to the number of partitions

35. Policy Query

36. Example

37. Trace

38. Experiments

39. Experiments