research-article

Higher-Order Relationship-Based Access Control: A Temporal Instantiation with IoT Applications

Authors:

Syed Zain R. Rizvi,

Philip W.L. FongAuthors Info & Claims

SACMAT '22: Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies

Pages 223 - 234

https://doi.org/10.1145/3532105.3535026

Published: 08 June 2022 Publication History

Abstract

Cyberphysical systems involve connected devices that are physically embedded. These devices enter into transient relationships with one another and with the environment. We propose an access control model, HO(T)-ReBAC, for facilitating access control in such dynamic environments. Specifically, HO(T)-ReBAC bases its authorization decisions on the history of relationship changes. We demonstrate the usefulness of this model in a case study on a Medical Internet-of-Things application. We extend a recently proposed graph matching algorithm to handle temporality in our model, thereby yielding an efficient authorization mechanism, the performance of which has been evaluated empirically. This model is the first instantiation of a general idea, Higher-Order Relationship-Based Access Control, that we have been developing.

References

[1]

Chahal Arora. 2022. Higher-Order (Temporal) Relationship-Based Access Control. Master's thesis. University of Calgary. http://hdl.handle.net/1880/114433

[2]

M. Ben-Ari. 2001. Mathematical logic for computer science (2nd ed.). Springer.

[3]

Elisa Bertino, Piero Andrea Bonatti, and Elena Ferrari. 2001. TRBAC: A Temporal Role-Based Access Control Model. ACM Trans. Inf. Syst. Secur. 4, 3 (2001), 191--233.

Digital Library

[4]

Glenn Bruns, Philip W.L. Fong, Ida Siahaan, and Michael Huth. 2012. Relationship-Based Access Control: Its Expression and Enforcement through Hybrid Logic. In Proceedings of the Second ACM Conference on Data and Application Security and Privacy (CODASPY '12). 117--124.

Digital Library

[5]

Yuan Cheng, Jaehong Park, and Ravi Sandhu. 2012. Relationship-Based Access Control for Online Social Networks: Beyond User-to-User Relationships. In 2012 International Conference on Privacy, Security, Risk and Trust and 2012 International Confernece on Social Computing. 646--655.

[6]

Jason Crampton and James Sellwood. 2014. Path Conditions and Principal Matching: A New Approach to Access Control. In Proceedings of the 19th ACM Symposium on Access Control Models and Technologies (SACMAT '14). 187--198.

Digital Library

[7]

Philip W.L. Fong. 2004. Access control by tracking shallow execution history. In Proceedings of the 2004 IEEE Symposium on Security and Privacy. 43--55.

[8]

Philip W.L. Fong. 2011. Preventing Sybil Attacks by Privilege Attenuation: A Design Principle for Social Network Systems. In 2011 IEEE Symposium on Security and Privacy (S&P '11). 263--278.

Digital Library

[9]

Philip W.L. Fong. 2011. Relationship-Based Access Control: Protection Model and Policy Language. In Proceedings of the First ACM Conference on Data and Application Security and Privacy (CODASPY '11). 191--202.

Digital Library

[10]

Philip W.L. Fong, Pooya Mehregan, and Ram Krishnan. 2013. Relational Abstraction in Community-Based Secure Collaboration. In Proceedings of the 18th ACM Conference on Computer & Communications Security (CCS '13). 585--598.

Digital Library

[11]

Philip W.L. Fong and Ida Siahaan. 2011. Relationship-Based Access Control Policies and Their Policy Languages. In Proc. of the 16th ACM Symp. on Access Control Models & Technologies (SACMAT '11). 51--60.

[12]

Swapnil Gandhi and Yogesh Simmhan. 2020. An Interval-centric Model for Distributed Computing over Temporal Graphs. In IEEE 36th International Conference on Data Engineering (ICDE). 1129--1140.

[13]

M. R. Garey and D. S. Johnson. 1979. Computers and Intractability. Freeman.

[14]

P. Hell and J. Nesetril. 2004. Graphs and Homomorphisms. Oxford Univ. Press.

[15]

Ed. Helly. 1923. Über Mengen konvexer Körper mit gemeinschaftlichen Punkte. Jahresbericht der Deutschen Mathematiker-Vereinigung 32 (1923), 175--176.

[16]

Padmavathi Iyer and Amirreza Masoumzadeh. 2019. Generalized Mining of Relationship-Based Access Control Policies in Evolving Systems. In Proc. of the 24th ACM Symp. on Access Control Models & Technologies (SACMAT '19). 135--140.

Digital Library

[17]

J.B.D. Joshi, E. Bertino, U. Latif, and A. Ghafoor. 2005. A generalized temporal role-based access control model. IEEE Trans. Knowl. Data. Eng. 17, 1 (2005), 4--23.

Digital Library

[18]

Ram Krishnan, Jianwei Niu, Ravi Sandhu, and William H. Winsborough. 2011. Group-Centric Secure Information-Sharing Models for Isolated Groups. ACM Trans. Inf. Syst. Secur. 14, 3, Article 23 (Nov. 2011), 29 pages.

Digital Library

[19]

Karl Krukow, Mogens Nielsen, and Vladimiro Sassone. 2008. A logical framework for history-based access control and reputation systems. Journal of Computer Security 16, 1 (2008), 63--101.

Digital Library

[20]

Wouter Kuijper and Victor Ermolaev. 2014. Sorting out Role Based Access Control. In Proceedings of the 19th ACM Symposium on Access Control Models and Technologies (SACMAT '14). 63--74.

Digital Library

[21]

Jure Leskovec. 2022. Stanford Large Network Dataset Collection. http://snap.stanford.edu/data

[22]

Jay Ligatti, Lujo Bauer, and David Walker. 2009. Run-Time Enforcement of Nonsafety Policies. ACM Trans. Inf. Syst. Secur. 12, 3, Article 19 (2009), 41 pages.

Digital Library

[23]

Gérard Ligozat. 2012. Qualitative spatial and temporal reasoning. Wiley.

[24]

Edelmira Pasarella and Jorge Lobo. 2017. A Datalog Framework for Modeling Relationship-Based Access Control Policies. In Proceedings of the 22nd ACM on Symposium on Access Control Models and Technologies (SACMAT '17). 91--102.

Digital Library

[25]

Henrique G. G. Pereira and Philip W. L. Fong. 2019. SEPD: An Access Control Model for Resource Sharing in an IoT Environment. In Computer Security -- ESORICS 2019, K. Sako, S. Schneider, and P. Y. A. Ryan (Eds.). Springer, 195--216.

[26]

Patrick Prosser. 1993. Hybrid Algorithms for the Constraint Satisfaction Problem. Computational Intelligence 9, 3 (Aug. 1993), 268--299.

[27]

Shriram Ramesh, Animesh Baranawal, and Yogesh Simmhan. 2021. Granite: A distributed engine for scalable path queries over temporal property graphs. J. Parallel and Distrib. Comput. 151 (2021), 94--111.

[28]

Syed Zain R. Rizvi and Philip W. L. Fong. 2018. Efficient Authorization of Graph Database Queries in an Attribute-Supporting ReBAC Model. In Proc. of the 8th ACM Conf. on Data & Application Security & Privacy (CODASPY '18). 204--211.

[29]

Syed Zain R. Rizvi and Philip W. L. Fong. 2020. Efficient Authorization of Graph-Database Queries in an Attribute-Supporting ReBAC Model. ACM Trans. Priv. Secur. 23, 4, Article 18 (July 2020), 33 pages.

Digital Library

[30]

C. Rost, K. Gomez, M. Täschner, P. Fritzsche, L. Schons, L. Christ, T. Adameit, M. Junghanns, and E. Rahm. 2021. Distributed temporal graph analytics with GRADOOP. The VLDB journal 31, 2 (2021), 375--401.

Digital Library

[31]

R.S. Sandhu, E.J. Coyne, H.L. Feinstein, and C.E. Youman. 1996. Role-based access control models. Computer 29, 2 (1996), 38--47.

Digital Library

[32]

Fred B. Schneider. 2000. Enforceable Security Policies. ACM Transactions on Information and System Security 3, 1 (2000), 30--50.

Digital Library

[33]

E. Uzun, V. Atluri, S. Sural, J. Vaidya, G. Parlato, A. L. Ferrara, and M. Parthasarathy. 2012. Analyzing Temporal Role Based Access Control Models. In Proc. 17th ACM Symp. on Access Control Models & Tech. (SACMAT '12). 177--186.

[34]

Peter van Beek. 2006. Backtracking search algorithms. In Handbook of Constraint Programming. Elsevier.

Cited By

Ahsan MPathan A(2025)A Comprehensive Survey on the Requirements, Applications, and Future Challenges for Access Control Models in IoT: The State of the ArtIoT10.3390/iot60100096:1(9)Online publication date: 24-Jan-2025
https://doi.org/10.3390/iot6010009
Praharaj LAmeer SGupta MSandhu R(2022)Attributes Aware Relationship-based Access Control for Smart IoT Systems2022 IEEE 8th International Conference on Collaboration and Internet Computing (CIC)10.1109/CIC56439.2022.00021(72-81)Online publication date: Dec-2022
https://doi.org/10.1109/CIC56439.2022.00021

Index Terms

Higher-Order Relationship-Based Access Control: A Temporal Instantiation with IoT Applications
1. Security and privacy
  1. Security services
    1. Access control

Recommendations

Relationship-based access control: protection model and policy language
CODASPY '11: Proceedings of the first ACM conference on Data and application security and privacy

Social Network Systems pioneer a paradigm of access control that is distinct from traditional approaches to access control. Gates coined the term Relationship-Based Access Control (ReBAC) to refer to this paradigm. ReBAC is characterized by the explicit ...
Entity-Based Access Control: supporting more expressive access control policies
ACSAC '15: Proceedings of the 31st Annual Computer Security Applications Conference

Access control is an important part of security that restricts the actions that users can perform on resources. Policy models specify how these restrictions are formulated in policies. Over the last decades, we have seen several such models, including ...
Interoperability of Relationship- and Role-Based Access Control
CODASPY '16: Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy

Relationship-Based Access Control (ReBAC) was recently proposed as a general-purpose, application-layer access control paradigm, such that authorization decisions are based on the relationship between the access requestor and the resource owner. A first,...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SACMAT '22: Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies

June 2022

282 pages

ISBN:9781450393577

DOI:10.1145/3532105

General Chair:
Sven Dietrich
City University of New York
,
Program Chairs:
Omar Chowdhury
The University of Iowa
,
Daniel Takabi
Georgia State University

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 08 June 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Natural Sciences and Engineering Research Council of Canada

Conference

SACMAT '22

Sponsor:

SIGSAC

SACMAT '22: The 27th ACM Symposium on Access Control Models and Technologies

June 8 - 10, 2022

NY, New York, USA

Acceptance Rates

Overall Acceptance Rate 177 of 597 submissions, 30%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

2
Total Citations
View Citations
115
Total Downloads

Downloads (Last 12 months)17
Downloads (Last 6 weeks)2

Reflects downloads up to 27 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Ahsan MPathan A(2025)A Comprehensive Survey on the Requirements, Applications, and Future Challenges for Access Control Models in IoT: The State of the ArtIoT10.3390/iot60100096:1(9)Online publication date: 24-Jan-2025
https://doi.org/10.3390/iot6010009
Praharaj LAmeer SGupta MSandhu R(2022)Attributes Aware Relationship-based Access Control for Smart IoT Systems2022 IEEE 8th International Conference on Collaboration and Internet Computing (CIC)10.1109/CIC56439.2022.00021(72-81)Online publication date: Dec-2022
https://doi.org/10.1109/CIC56439.2022.00021

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten