Risk Based Access Control with Uncertain and Time-dependent Sensitivity

TY - GEN

T1 - Risk Based Access Control with Uncertain and Time-dependent Sensitivity

AU - Clark, John A.

AU - Tapiador, Juan E.

AU - McDermid, John A.

AU - Cheng, Pau-Chen

AU - Agrawal, Dakshi

AU - Ivanic, Natalie

AU - Slogget, Dave

N1 - SECRYPT is part of ICETE - The International Joint Conference on e-Business and Telecommunications

PY - 2010

Y1 - 2010

N2 - In traditional multi-level security (MLS) models, object labels are fixed assessments of sensitivity. In practice there will inevitably be some uncertainty about the damage that might be caused if a document falls into the wrong hands. Furthermore, unless specific management action is taken to regrade the label on an object, it does not change. This does not reflect the operational reality of many modern systems where there is clearly a temporal element to the actual sensitivity of information. Tactical information may be highly sensitive right now but comparatively irrelevant tomorrow whilst strategic secrets may need to be maintained for many years, decades, or even longer. In this paper we propose to model both security labels and clearances as probability distributions. We provide practical templates to model both uncertainty and temporally characterized dependencies, and show how these features can be naturally integrated into a recently proposed access control framework based on quantified risk.

AB - In traditional multi-level security (MLS) models, object labels are fixed assessments of sensitivity. In practice there will inevitably be some uncertainty about the damage that might be caused if a document falls into the wrong hands. Furthermore, unless specific management action is taken to regrade the label on an object, it does not change. This does not reflect the operational reality of many modern systems where there is clearly a temporal element to the actual sensitivity of information. Tactical information may be highly sensitive right now but comparatively irrelevant tomorrow whilst strategic secrets may need to be maintained for many years, decades, or even longer. In this paper we propose to model both security labels and clearances as probability distributions. We provide practical templates to model both uncertainty and temporally characterized dependencies, and show how these features can be naturally integrated into a recently proposed access control framework based on quantified risk.

UR - http://www.scopus.com/inward/record.url?scp=78651440675&partnerID=8YFLogxK

M3 - Conference contribution

SP - 1

EP - 9

BT - Proceedings of the 2010 International Conference on Security and Cryptography

A2 - Katsikas, Sokratis

A2 - Samarati, Pierangela

PB - SciTePress

T2 - International Conference on Security and Cryptography (SECRYPT)

Y2 - 26 June 2010 through 28 June 2010

ER -