7 Using Trust for RoleBased Access Control RBAC

7. Using Trust for Role-Based Access Control (RBAC) Prof. Bharat Bhargava Center for Education and Research in Information Assurance and Security (CERIAS) and Department of Computer Sciences Purdue University http: //www. cs. purdue. edu/people/bb bb@cs. purdue. edu Collaborators in the RAID Lab (http: //raidlab. cs. purdue. edu): Prof. Leszek Lilien (former Post Doc) Dr. Yuhui Zhong (former Ph. D. Student) This research is supported by CERIAS and NSF grants from IIS and ANIR. 1 --- 9/17/2020 8: 01: 03 PM

Using Trust for Role-Based Access Control - Outline 1) Access Control in Open Systems 2) Proposed Access Control Architecture 2. 1) Basics 2. 2) RBAC & TERM server 3) TERM server 3. 1) Basic 3. 2) Evidence Model 3. 3) Architecture a) b) c) d) Credential Management (CM) Evidence Evaluation (EE) Role Assignment (RA) Trust Information Management (TIM) 3. 4) Prototype TERM server 2 --- 9/17/2020 8: 01: 04 PM

1) Access Control in Open Systems (1) § Open environment (like WWW, Wi. Fi networks) § User who may not be known in advance § Still must determine the permission set for an unknown user § Common approach: Grant access based on user’s properties demonstrated by digital credentials § Problems with credentials § Holding credentials does not assure user trustworthiness § Evidence provided by different credential issuers should not be uniformly trusted (apply “degrees of trust”) 3 --- 9/17/2020 8: 01: 05 PM

1) Access Control in Open Systems (2) § A solution for problems with credentials: § Trust should be used by access control mechanisms § To limit granting privileges to potentially harmful users n How to establish trust ? n n n In particular with “newcomer” devices What do we need to know about a pervasive device, in order to make a trust decision? Using trust for attribute-based access control n Identity-based access control is inadequate in open environments (e. g. , vulnerable to masquerading) n Multi-dimensional attribute set to determine trust level 4 --- 9/17/2020 8: 01: 06 PM

2. 1) Proposed Access Control Architecture - Basics Authorized Users Other Users Access Control Mechanism Information System § Authorized Users § Validated credentials (first-hand experience and second-hand recommendations) AND § Trust based on history of cooperative and legitimate behavior § Other Users § Lack of required credentials OR § Lack of trust resulting from history of non-cooperative or malicious behavior 5 --- 9/17/2020 8: 01: 06 PM

2. 2) Proposed Access Control Architecture - RBAC & TERM Server n n Role-based access control (RBAC) Trust-enhanced role-mapping (TERM) server cooperates with RBAC Request roles TERM Server user Send roles Request Access Respond RBAC enhanced Web Server 6 --- 9/17/2020 8: 01: 07 PM

3. 1) TERM Server - Basic Concepts (1) n Evidence n n Credentials § Statement about some properties of a subject § Examples: X. 509, PICS rating Issuer’s opinion § Allows issuer to express confidence w. r. t. her statement (recommendation) § Widely used in daily life n Example: Reviewer’s familiarity with topic on review forms § Not supported by current credentials n n Evidence § Associate issuer’s opinion with credentials Reliability of evidence § Trust w. r. t. evidence from the viewpoint of the relying entity (i. e. TERM server) § Combination of the trust w. r. t. the issuer and the issuer’s opinion 7 --- 9/17/2020 8: 01: 09 PM

3. 1) TERM Server - Basic Concepts n (2) Trust based on interpretation of observations of users behaviors n Inherently uncertain § User’s behavior affected by multiple reasons § Example: Reasons why a user provides incorrect information n n Dishonesty / Error / Other reasons Trust context n Trust is context-specific § Example: Bob trusts his doctor w. r. t. health problems but not w. r. t. flying with him n n n Different trust characteristics are emphasized in different contexts Trust characteristisc may have different meanings in different contexts Research questions: § How to represent contexts? § How to propagate trust among contexts? n Trust in a user and issuer (of recommendations) n n Trusting a user: belief that user is cooperative Trusting an issuer: believe evidence provided by issuer 8 --- 9/17/2020 8: 01: 10 PM

3. 2) TERM Server – Evidence Model (1) n Direct experience n n n User’s or recommendation issuer’s behavior observed by TERM First-hand information Recommendation n n Recommender’s opinion w. r. t. trust in a user/issuer Second-hand information 9 --- 9/17/2020 8: 01: 12 PM

3. 2) Evidence Model (2) n n Design considerations: n Accommodate different forms of evidence in an integrated framework n Support reliability evaluation Evidence type n n Specify information required by this kind of evidence (et_id, (attr_name, attr_domain, attr_type) *) E. g. : (student, [{name, string, mand}, {university, string, mand}, {department, string, opt}]) Evidence n Evidence is an instance of an evidence type 10 --- 9/17/2020 8: 01: 12 PM

3. 2) Evidence Model (3) n Opinion n n (belief, disbelief, uncertainty) Probability expectation of Opinion § Belief + 0. 5 * uncertainty § Characterizes the degree of trust represented by an opinion Alternative representation § Fuzzy expression § Uncertainty vs. vagueness Evidence statement n <issuer, subject, evidence, opinion> 11 --- 9/17/2020 8: 01: 14 PM

3. 3) TERM Server Architecture (1) users’ behaviors user’s trust information mgmt issuer’s trust user/issuer information database role assignment assigned roles evidence evaluation evidence statement, reliability evidence statement credential mgmt Component implemented Component partially implemented a) b) c) d) credentials provided by third parties or retrieved from the internet role-assignment policies specified by system administrators Credential Management (CM) – simply transforms different formats of credentials to evidence statements Evidence Evaluation (EE) - evaluates reliability of evidence statements Role Assignment (RA) - maps roles to users based on evidence statements and role assignment policies Trust Information Management (TIM) - evaluates user/issuer’s trust information based on direct experience and recommendations 12 --- 9/17/2020 8: 01: 16 PM

a) CM - Credential Management n Transforms different formats of credentials to evidence statements 13 --- 9/17/2020 8: 01: 21 PM

b) EE - Evidence Evaluation n n Develop an algorithm to evaluate reliability of evidence n Issuer’s opinion cannot be used as reliability of evidence Two types of information used: n Evidence Statement § Issuer’s opinion § Evidence type n Trust w. r. t. issuer for this kind of evidence type 14 --- 9/17/2020 8: 01: 22 PM

Evidence Evaluation Algorithm Input: evidence statement E 1 = <issuer, subject, evidence, opinion 1> Output: reliability RE(E 1) of evidence statement E 1 Step 1: get opinion 1 = <b 1, d 1, u 1> and issuer field from evidence statement E 1 Step 2: get the evidence statement about issuer’s testify_trust E 2 = <term_server, issuer, testify_trust, opinion 2> from local database Step 3: get opinion 2 = <b 2, d 2, u 2> from evidence statement E 2 Step 4: compute opinion 3 = <b 3, d 3, u 3 > (1) b 3 = b 1 * b 2 (2) d 3 = b 1 * d 2 (3) u 3 = d 1 + u 1 + b 2 * u 1 Step 5: compute probability expectation for opinion 3 = < b 3, d 3, u 3 > PE (opinion 3) = b 3 + 0. 5 * u 3 Step 6: RE (E 1) = PE (opinion 3) 15 --- 9/17/2020 8: 01: 23 PM

c) RA - Role Assignment n Design a declarative language for system administrators to define role assignment policies n n Specify content and number of evidence statements needed for role assignment Define a threshold value characterizing the minimal degree of trust expected for each evidence statement Specify trust constraints that a user/issuer must satisfy to obtain a role Develop an algorithm to assign roles based on policies n Several policies may be associated with a role The role is assigned if one of them is satisfied n A policy may contain several units The policy is satisfied if all units evaluate to True 16 --- 9/17/2020 8: 01: 26 PM

RA Algorithm for Policy Evaluation Input: evidence set E and their reliability, role A Output: true/false P ← the set of policies whose left hand side is role A while P is not empty{ q = a policy in P satisfy = true for each units u in q{ if evaluate_unit(u, e, re(e)) = false for all evidence statements e in E satisfy = false } if satisfy = true return true else remove q from P } return false 17 --- 9/17/2020 8: 01: 28 PM

RA Algorithm for Unit Evaluation Input: evidence statement E 1 <issuer, subject, evidence, opinion 1> and its reliability RE (E 1), a unit of a policy U Output: true/false Step 1: if issuer does not hold the Issuer. Role specified in U or the type of evidence does not match evidence_type in U then return false Step 2: evaluate Exp of U as follows: (1) if Exp 1 = “Exp 2 || Exp 3” then result(Exp 1) = max(result(Exp 2), result(Exp 3)) (2) else if Exp 1 = “Exp 2 && Exp 3” then result(Exp 1) = min(result(Exp 2), result(Exp 3)) (3) else if Exp 1 = “attr Op Constant” then if Op {EQ, GT, LT, EGT, ELT} then if “attr Op Constant” = true then result(Exp 1) = RE(E 1) else result(Exp 1) = 0 else if Op = NEQ” then if “attr Op Constant” = true then result(Exp 1) = RE(E 1) else result(Exp 1) = 1 - RE(E 1) Step 3: if min(result(Exp), RE(E 1)) threshold in U then output true else output false 18 --- 9/17/2020 8: 01: 28 PM

d) TIM - Trust Information Management n Evaluate “current knowledge” n “Current knowledge: ” § Interpretations of observations § Recommendations n n n Developed algorithm that evaluates trust towards a user User’s trustworthiness affects trust towards issuers who introduced user Predict trustworthiness of a user/issuer n Current approach uses the result of evaluation as the prediction 19 --- 9/17/2020 8: 01: 32 PM

3. 4) Prototype TERM Server Defining role assignment policies Loading evidence for role assignment Software: http: //www. cs. purdue. edu/homes/bb/NSFtrust. html 20 --- 9/17/2020 8: 01: 34 PM

Our Research at Purdue § Web Site: http/www. cs. purdue. edu/homes/bb § Over one million dollars in current support from: NSF, Cisco, Motorola, DARPA § Selected Publications § B. Bhargava and Y. Zhong, "Authorization Based on Evidence and Trust", in Proc. of Data Warehouse and Knowledge Management Conference (Da. Wa. K), Sept. 2002. § E. Terzi, Y. Zhong, B. Bhargava, Pankaj, and S. Madria, "An Algorithm for Building User-Role Profiles in a Trust Environment", in Proc. of Da. Wa. K, Sept. 2002. § A. Bhargava and M. Zoltowski, “Sensors and Wireless Communication for Medical Care, ” in Proc. of 6 th Intl. Workshop on Mobility in Databases and Distributed Systems (MDDS), Prague, Czechia, Sept. 2003. § B. Bhargava, Y. Zhong, and Y. Lu, "Fraud Formalization and Detection", in Proc. of Da. Wa. K, Prague, Czech Republic, Sept. 2003. 21 --- 9/17/2020 8: 01: 38 PM

THE END 22 --- 9/17/2020 8: 01: 40 PM