The goal of this paper is to present a new model for, or rather a new way of thinking of adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty in access control decisions and such uncertainty leads to unpredictable risk that should be addressed in an explicit way. Many different access control models have been studied and practiced extensively. We choose to expand the well–known, Bell–Lapadula model based Multi–Level Security (MLS) access control model as a proof–of–concept case study for our basic premise. The resulting access control model is more like a Fuzzy Logic control system [Jyh97] than a traditional access control system and hence the name “Fuzzy MLS”. A short, but more recent version of this article is to appear in the 2007 IEEE Symposium on Security and Privacy.
By: Pau-Chen Cheng; Pankaj Rohatgi; Claudia Keser; Paul A. Karger; Grant M. Wagner; Angela Schuett Reninger
Published in: RC24190 in 2007
LIMITED DISTRIBUTION NOTICE:
This Research Report is available. This report has been submitted for publication outside of IBM and will probably be copyrighted if accepted for publication. It has been issued as a Research Report for early dissemination of its contents. In view of the transfer of copyright to the outside publisher, its distribution outside of IBM prior to publication should be limited to peer communications and specific requests. After outside publication, requests should be filled only by reprints or legally obtained copies of the article (e.g., payment of royalties). I have read and understand this notice and am a member of the scientific community outside or inside of IBM seeking a single copy only.
Questions about this service can be mailed to reports@us.ibm.com .