Attribute-based access control: Difference between revisions

Revision as of 01:01, 17 June 2022

Revision as of 08:32, 17 June 2022

Line 1:

'''Attribute-based access control''' ('''ABAC'''), also known as '''policy-based access control''' for [[Identity management|IAM]], defines an access control paradigm whereby a subject's authorization to perform a set of operations is determined by evaluating attributes associated with the subject, object, requested operations, and, in some cases, environment attributes.<ref>{{Cite web|last=Computer Security Division|first=Information Technology Laboratory|date=2016-05-24|title=Attribute Based Access Control {{!}} CSRC {{!}} CSRC|url=https://csrc.nist.gov/Projects/Attribute-Based-Access-Control|access-date=2021-11-25|website=CSRC {{!}} NIST|language=EN-US}}</ref>

ABAC policy rules are generated as Boolean functions of the subject's attributes, the object's attributes, and the environment attributes.<ref>{{Cite web |title=Guide to Secure Web Services: Recommendations of the National Institute of Standards and Technology |url=https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-95.pdf}}</ref>

of Standards and Technology |url=https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-95.pdf}}</ref>

Unlike [[RBAC|role-based access control (RBAC)]], which defines roles that carry a specific set of privileges associated with them and to which subjects are assigned, ABAC can express complex rule sets that can evaluate many different attributes.

Attribute values can be set-valued or atomic-valued. Set-valued attributes contain more than one atomic value. Examples are ''role'' and ''project''. Atomic-valued attributes contain only one atomic value. Examples are ''clearance'' and ''sensitivity''. Attributes can be compared to static values or to one another, thus enabling relation-based access control.

Although the concept itself existed for many years, ABAC is considered a "next generation" authorization model because it provides dynamic, context-aware and risk-intelligent access control to resources allowing access control policies that include specific attributes from many different information systems to be defined to resolve an authorization and achieve an efficient regulatory compliance, allowing enterprises flexibility in their implementations based on their existing infrastructures.

Attribute-based access control is sometimes referred to as '''policy-based access control''' ('''PBAC''') or '''claims-based access control''' ('''CBAC'''), which is a Microsoft-specific term. The key standards that implement ABAC are [[XACML]] and [[ALFA (XACML)]].<ref>{{Cite journal|last1=Silva|first1=Edelberto Franco|last2=Muchaluat-Saade|first2=Débora Christina|last3=Fernandes|first3=Natalia Castro|date=2018-01-01|title=ACROSS: A generic framework for attribute-based access control with distributed policies for virtual organizations|url=http://www.sciencedirect.com/science/article/pii/S0167739X17316060|journal=Future Generation Computer Systems|language=en|volume=78|pages=1–17|doi=10.1016/j.future.2017.07.049|issn=0167-739X}}</ref>

Line 47 ⟶ 46:

==Implementations==

One standard that implements attribute- and policy-based access control is [[XACML]], the eXtensible Access Control Markup Language. XACML defines an architecture, a policy language, and a request/ response scheme. It does not handle attribute management (user attribute assignment, object attribute assignment, environment attribute assignment) which is left to traditional [[Identity_managementIdentity management|IAM]] tools, databases, and directories.

Companies, including every branch in the United States military, have started using ABAC. At a basic level, ABAC protects data with ‘IF/THEN/AND’ rules rather than assign data to users. The US Department of Commerce has made this a mandatory practice and the adoption is spreading throughout several governmental and military agencies.<ref>{{Cite web|url=https://community.plm.automation.siemens.com/t5/Digital-Transformations/Attribute-Based-Access-Control-ABAC-Encryption-on-Steroids/ba-p/580836|title=Attribute Based Access Control (ABAC) – Encryption on Steroids|last=Coffey|first=Alisa|date=2019-03-28|website=Siemens PLM Community|language=en|access-date=2019-04-01}}</ref>

==Applications==

The concept of ABAC can be applied at any level of the technology stack and an enterprise infrastructure. For example, ABAC can be used at the firewall, server, application, database, and data layer. The use of attributes bring additional context to evaluate the legitimacy of any request for access and inform the decision to grant or deny access.

An important consideration when evaluating ABAC solutions is to understand its potential overhead on performance and its impact on the user experience. It is expected that the more granular the controls, the higher the overhead.

=== API and microservices security ===

Line 141 ⟶ 140:

* [https://f5.com/about-us/blog/articles/abac-not-rbac-welcome-to-the-iot-world-of-contextual-security ABAC not RBAC: Welcome to the (IoT) World of Contextual Security, 2015, Lori MacVittie]

* [https://plus.kuppingercole.com/article/mc71144/dynamic-authorization-management Market Compass: Dynamic Authorization Management, 2020, Graham Williamson]

[[Category:Access control]]