It is our great pleasure to welcome you to the 28th ACM Symposium on Access Control Models and Technologies (SACMAT 2023). This year's symposium continues its tradition of being the premier venue for presenting research results and experience reports on cutting edge advances on access control, including models, systems, applications, and theory, while also embracing a renovated focus on the general area of computer security.
The overarching goal of the symposium is to share novel access control and computer security solutions that fulfill the needs of emerging applications and environments, and also to identify new directions for future research and development. ACM SACMAT provides researchers and also practitioners with a unique opportunity to share their perspectives with others interested in the various aspects of access control and computer security.
Like last year, we had two submission cycles, one in Fall 2022 and another in Spring 2023. We received a total of 49 submissions from different countries around the world.
Proceeding Downloads
The Category-Based Approach to Access Control, Obligations and Privacy
The category-based access control metamodel provides an axiomatic framework for the specification of access control models. In this talk, we give an overview of the category-based approach to access control, obligation and privacy policy specification.
WebSheets: A New Privacy-Centric Framework for Web Applications
Spreadsheets are enormously popular because they enable non-programmers to create applications that manipulate tabular data. The core functionality of many web applications is to display and manipulate tabular data, typically stored in databases. These ...
Access Control Vulnerabilities in Network Protocol Implementations: How Attackers Exploit Them and What To Do About It
Authentication and access control mechanisms should verify the identity of users of a system and ensure that these users only act within their intended permissions. These mechanisms, alongside audit or intrusion detection, have been called the "...
A Framework for Privacy-Preserving White-Box Anomaly Detection using a Lattice-Based Access Control
Privacy concerns are amongst the core issues that will constrain the adoption of distributed anomaly detection. Indeed, when outsourcing anomaly detection, i.e. with a party other than the data owner running the detection, confidential or private aspects ...
Privacy-Preserving Multi-Party Access Control for Third-Party UAV Services
Third-Party Unmanned Aerial Vehicle (UAV) Services, a.k.a. Drone-as-a-Service (DaaS), are an increasingly adopted business model, which enables possibly unskilled users, with no background knowledge, to operate drones and run automated drone-based tasks. ...
Federated Synthetic Data Generation with Stronger Security Guarantees
Synthetic data generation plays a crucial role in many areas where data is scarce and privacy/confidentiality is a significant concern. Generative Adversarial Networks (GANs), arguably one of the most widely used data synthesis techniques, allow for the ...
Demo: A Multimodal Behavioral Biometric Scheme for Smartphone User Authentication (MBBS)
In this demo paper, we introduce MBBS - a tetra-model behavioral biometric authentication scheme for smartphones. MBBS leverages four modalities: the way a smartphone user (i) swipes on the touchscreen, (ii) taps any combination of ''text-independent" 8-...
Poster: APETEEt -- Secure Enforcement of ABAC Policies using Trusted Execution Environment
We introduce a novel framework for efficient enforcement of Attribute-Based Access Control (ABAC) policies using trusted execution environment. An ABAC policy is represented in the form of a height-balanced tree constructed and deployed in the trusted ...
Poster: Attribute Based Access Control for IoT Devices in 5G Networks
The deployment of 5G technology has the potential to usher in a new era for the internet of things (IoT). The introduction of new use cases, such as massive machine-type communications (mMTC), referring to a large number of IoT devices, resulting in the ...
Poster: How to Raise a Robot - Beyond Access Control Constraints in Assistive Humanoid Robots
Humanoid robots will be able to assist humans in their daily life, in particular due to their versatile action capabilities. However, while these robots need a certain degree of autonomy to learn and explore, they also should respect various constraints, ...
Poster: Integrating Spatio-temporal Authorization with Generic Cloud-based Software Architecture for Internet of Things Devices
The significant rise in the usage of IoT devices and their security issues has created a demand for improved security for these systems. Unfortunately, no standard IoT architecture exists, making the development of security solutions for IoT systems ...
Poster: Non-repudiable Secure Logging System for the Web
To resolve disputes between servicers providing web services and their users, non-repudiable evidence is crucial because it allows one party to dismiss the denial of facts or false allegations. We propose a logger that securely records web requests and ...
SEAL: Capability-Based Access Control for Data-Analytic Scenarios
Data science is the basis for various disciplines in the Big-Data era. Due to the high volume, velocity, and variety of big data, data owners often store their data in data servers. Past few years, many computation techniques have emerged to protect the ...
SpaceMediator: Leveraging Authorization Policies to Prevent Spatial and Privacy Attacks in Mobile Augmented Reality
Mobile Augmented Reality (MAR) is a portable, powerful, and suitable technology that integrates digital content, e.g., 3D virtual objects, into the physical world, which not only has been implemented for multiple intents such as shopping, entertainment, ...
Synthesizing and Analyzing Attribute-Based Access Control Model Generated from Natural Language Policy Statements
Access control policies (ACPs) are natural language statements that describe criteria under which users can access resources. We focus on constructing NIST Next Generation Access Control (NGAC) ABAC model from ACP statements. NGAC is more complex than ...
Security Analysis of Access Control Policies for Smart Homes
Ensuring security is crucial in smart home settings, where only authorized users should have access to home devices. Over the past decade, researchers have focused on developing access control policies and evaluating their efficacy in preventing ...
Expressive Authorization Policies using Computation Principals
In authorization logics, it is natural to treat computations as principals, since systems need to decide how much authority to give computations when they execute. But unlike other kinds of principals, the authority that we want to give to computations ...
MSNetViews: Geographically Distributed Management of Enterprise Network Security Policy
- Iffat Anjum,
- Jessica Sokal,
- Hafiza Ramzah Rehman,
- Ben Weintraub,
- Ethan Leba,
- William Enck,
- Cristina Nita-Rotaru,
- Bradley Reaves
Commercially-available software defined networking (SDN) technologies will play an important role in protecting the on-premises resources that remain as enterprises transition to zero trust architectures. However, existing solutions assume the entire ...

The Hardness of Learning Access Control Policies
The problem of learning access control policies is receiving increasing attention in research. We contribute to the foundations of this problem by posing and addressing meaningful questions on computational hardness. Our work addresses learning access ...
SAFE-PASS: Stewardship, Advocacy, Fairness and Empowerment in Privacy, Accountability, Security, and Safety for Vulnerable Groups
- Indrajit Ray,
- Bhavani Thuraisingham,
- Jaideep Vaidya,
- Sharad Mehrotra,
- Vijayalakshmi Atluri,
- Indrakshi Ray,
- Murat Kantarcioglu,
- Ramesh Raskar,
- Babak Salimi,
- Steve Simske,
- Nalini Venkatasubramanian,
- Vivek Singh
Our vision is to achieve societally responsible secure and trustworthy cyberspace that puts algorithmic and technological checks and balances on the indiscriminate sharing and analysis of data. We achieve this vision in a holistic manner by framing ...
Sidecar-based Path-aware Security for Microservices
Microservice architectures decompose web applications into loosely-coupled, distributed components that interact with each other to provide an overall service. While this popular software architecture paradigm has many advantages in development and ...
Towards Automated Learning of Access Control Policies Enforced by Web Applications
Obtaining an accurate specification of the access control policy enforced by an application is essential in ensuring that it meets our security/privacy expectations. This is especially important as many of real-world applications handle a large amount ...
Coverage-Based Testing of Obligations in NGAC Systems
The administrative obligation is a unique feature of Next Generation Access Control (NGAC), a standard for implementing fine-grained attribute-based access control. It provides a programming mechanism for run-time privilege changes by attaching ...
Data Sharing in Social Networks
In the context of multi-user cooperative systems and, in particular, in social networks, personal data is uploaded to user profiles and shared with other users. These data are often jointly owned and associated with different degrees of sensitivity ...
Specifying a Usage Control System
Modern system architectures require sophisticated access and usage control mechanisms. The need stems from demanding requirements for security, data sovereignty and privacy regulations, as well as the challenges presented by architectural approaches like ...
Qualitative Intention-aware Attribute-based Access Control Policy Refinement
Designing access control policies is often expensive and tedious due to the heterogeneous systems, services, and diverse user demands. Although ABAC policy and decision engine creation methods based on machine learning have been proposed, they cannot ...
Recommendations
Acceptance Rates
Year | Submitted | Accepted | Rate |
---|---|---|---|
SACMAT '19 | 52 | 12 | 23% |
SACMAT '18 | 50 | 14 | 28% |
SACMAT '17 Abstracts | 50 | 14 | 28% |
SACMAT '16 | 55 | 18 | 33% |
SACMAT '15 | 59 | 17 | 29% |
SACMAT '14 | 58 | 17 | 29% |
SACMAT '13 | 62 | 19 | 31% |
SACMAT '12 | 73 | 19 | 26% |
SACMAT '09 | 75 | 24 | 32% |
SACMAT '03 | 63 | 23 | 37% |
Overall | 597 | 177 | 30% |