Deconflicting Policies in Attribute-Based Access Control Systems

摘要

Attribute-Based Access Control (ABAC) is a promising next generation access control model that can bring great benefit in the context of sharing and securing sensitive data. However, such systems are complex to analyze and usually suffer from anomalies and conflicts between security policies. That is the situation where multiple policies provide conflicting answers (permit/deny) to a same access request. In this paper we deal with this problem and we propose a comprehensive framework that can support security administrators with tools to continuously analyze, detect and resolve any possible conflicts in ABAC systems.