Abstract
In the realm of access control mechanisms, Attribute-Based Access Control (ABAC) stands out for its dynamic and fine-grained approach, enabling permissions to be allocated based on attributes of subjects, objects, and the environment. This paper introduces a graph model for ABAC, named \(G_{ABAC}\). The \(G_{ABAC}\) leverages directional flow capacities to enforce access control policies, mapping the potential pathways between a subject and an object to ascertain access rights. Furthermore, graph based modeling of ABAC enables the utilization of readily available commercial graph database systems to implement ABAC. As a result, enforcement and analyses of ABAC can be accomplished simply through graph queries. In particular, we demonstrate this using the Neo4j graph database and present the performance of executing enforcement and different analyses queries.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
The eXtensible Access Control Markup Language (XACML), Version 3.0, OASIS Standard, 22 January 2013. http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.pdf
The Harmonia Open Source Software from NIST. https://github.com/PM-Master/Harmonia-1.6/releases
Top Ten Reasons for Choosing Neo4j. https://neo4j.com/top-ten-reasons/
Welcome to Neo4j. https://neo4j.com/docs/getting-started/
Abdelgawad, M., Ray, I., Alqurashi, S., Venkatesha, V., Shirazi, H.: Synthesizing and analyzing attribute-based access control model generated from natural language policy statements. In: Proceedings of the 28th ACM Symposium on Access Control Models and Technologies, pp. 91–98 (2023)
Ahmadi, H., Small, D.: Graph model implementation of attribute-based access control policies. CoRR abs/1909.09904 (2019)
Alves, S., Fernández, M.: A graph-based framework for the analysis of access control policies. Theoret. Comput. Sci. 685, 3–22 (2017)
Bertolissi, C., Fernandez, M., Thuraisingham, B.: Graph-based specification of admin-CBAC policies. In: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp. 173–184 (2021)
Ferraiolo, D., Atluri, V., Gavrila, S.: The policy machine: a novel architecture and framework for access control policy specification and enforcement. J. Syst. Architect. 57(4), 412–424 (2011)
Ferraiolo, D., Sandhu, R., Gavrila, S., Kuhn, D.R., Chandramouli, R.: Proposed NIST standard for role-based access control. ACM Trans. Inf. Syst. Secur. 4(3), 224–274 (2001)
Hu, V., et al.: Guide to attribute based access control (ABAC) definition and considerations (2019)
Koch, M., Mancini, L.V., Parisi-Presicce, F.: Conflict detection and resolution in access control policy specifications. In: Foundations of Software Science and Computation Structures, pp. 223–238 (2002)
Mohamed, A., Auer, D., Hofer, D., KĂĽng, J.: Extended authorization policy for graph-structured data. SN Comput. Sci. 2, 351 (2021)
Nabil, D., Slimani, H., Nacer, H., Aissani, D., Bey, K.B.: ABAC conceptual graph model for composite web services. In: 2018 IEEE 5th International Congress on Information Science and Technology (CiSt), pp. 36–41 (2018)
Nyanchama, M., Osborn, S.: The role graph model and conflict of interest. ACM Trans. Inf. Syst. Secur. 2(1), 3–33 (1999)
Rizvi, S.Z.R., Fong, P.W.L.: Efficient authorization of graph-database queries in an attribute-supporting ReBAC model. ACM Trans. Priv. Secur. 23(4), 1–33 (2020)
Servos, D., Osborn, S.L.: Current research and open problems in attribute-based access control. ACM Comput. Surv. 49(4), 1–45 (2017)
Talegaon, S., Batra, G., Atluri, V., Sural, S., Vaidya, J.: Contemporaneous update and enforcement of ABAC policies. In: Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies (SACMAT), pp. 31–42 (2022)
Talukdar, T., Batra, G., Vaidya, J., Atluri, V., Sural, S.: Efficient bottom-up mining of attribute based access control policies. In: IEEE International Conference on Collaboration and Internet Computing, pp. 339–348 (2017)
Uzun, E., et al.: Analyzing temporal role based access control models. In: Proceedings of the 17th ACM Symposium on Access Control Models and Technologies, SACMAT 2012, pp. 177–186 (2012)
Zhang, S., Fong, P.W.L.: Mining domain-based policies. In: Proceedings of the 14th ACM Conference on Data and Application Security and Privacy (CODASPY) (2024)
Acknowledgments
This research was supported in part by the National Science Foundation award CNS-1747728, the National Institutes of Health award R35GM134927 and a grant from CISCO Research. The content is solely the responsibility of the authors and does not necessarily represent the official views of the agencies funding the research.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Python and Neo4j Code
A Python and Neo4j Code
1.1 A.1 Code for Access Request Evaluation

1.2 A.2 Code for User-Centric Analysis

1.3 A.3 Code for Object-Centric Analysis

Rights and permissions
Copyright information
© 2024 IFIP International Federation for Information Processing
About this paper
Cite this paper
Yang, M., Atluri, V., Sural, S., Vaidya, J. (2024). A Graph-Based Framework for ABAC Policy Enforcement and Analysis. In: Ferrara, A.L., Krishnan, R. (eds) Data and Applications Security and Privacy XXXVIII. DBSec 2024. Lecture Notes in Computer Science, vol 14901. Springer, Cham. https://doi.org/10.1007/978-3-031-65172-4_1
Download citation
DOI: https://doi.org/10.1007/978-3-031-65172-4_1
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-65171-7
Online ISBN: 978-3-031-65172-4
eBook Packages: Computer ScienceComputer Science (R0)