Detecting and resolving policy misconfigurations in access-control systems
Abstract
Access-control policy misconfigurations that cause requests to be erroneously denied can result in wasted time, user frustration, and, in the context of particular applications (e.g., health care), very severe consequences. In this article we apply association rule mining to the history of accesses to predict changes to access-control policies that are likely to be consistent with users' intentions, so that these changes can be instituted in advance of misconfigurations interfering with legitimate accesses. Instituting these changes requires the consent of the appropriate administrator, of course, and so a primary contribution of our work is how to automatically determine from whom to seek consent and how to minimize the costs of doing so. We show using data from a deployed access-control system that our methods can reduce the number of accesses that would have incurred costly time-of-access delays by 43%, and can correctly predict 58% of the intended policy. These gains are achieved without impacting the total amount of time users spend interacting with the system.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- May 01, 2011
- Source ID
- 10.1145/1952982.1952984
Entities
People
- Lujo Bauer
- Michael Reiter
- Scott Garriss
Organizations
- Air Force Research Laboratory
- Army Research Office
- Carnegie Mellon University
- National Science Foundation
- Office of Naval Research
- University of North Carolina at Chapel Hill