Risk-Aware Fine-Grained Access Control in Cyber-Physical Contexts
This work addresses the problem of fine-grained access control for protecting private health information in healthcare settings, representing an incremental improvement with a novel method for a known bottleneck.
The paper tackles the challenge of managing context-sensitive access control in dynamic cyber-physical environments by proposing RASA, an unsupervised machine learning approach that automatically infers risk-based authorization decision boundaries, achieving over 99% consistency with a heuristic rule-based policy in evaluations.
Access to resources by users may need to be granted only upon certain conditions and contexts, perhaps particularly in cyber-physical settings. Unfortunately, creating and modifying context-sensitive access control solutions in dynamic environments creates ongoing challenges to manage the authorization contexts. This paper proposes RASA, a context-sensitive access authorization approach and mechanism leveraging unsupervised machine learning to automatically infer risk-based authorization decision boundaries. We explore RASA in a healthcare usage environment, wherein cyber and physical conditions create context-specific risks for protecting private health information. The risk levels are associated with access control decisions recommended by a security policy. A coupling method is introduced to track coexistence of the objects within context using frequency and duration of coexistence, and these are clustered to reveal sets of actions with common risk levels; these are used to create authorization decision boundaries. In addition, we propose a method for assessing the risk level and labelling the clusters with respect to their corresponding risk levels. We evaluate the promise of RASA-generated policies against a heuristic rule-based policy. By employing three different coupling features (frequency-based, duration-based, and combined features), the decisions of the unsupervised method and that of the policy are more than 99% consistent.