IEEE Transactions on Dependable and Secure Computing, 2000
Large amount of data and increased demand to extract, analyze and derive knowledge from data are ... more Large amount of data and increased demand to extract, analyze and derive knowledge from data are impairing nowadays performance of enterprise missioncritical systems such as databases. For databases, the challenging problem is to manage complex and sometimes nonoptimized queries executed on enormous datasets stored across several tables. This generally results in increased query response time and loss of employees productivity. In this paper, we investigate the problem of enterprise computing resources availability. Our goal is to minimize performance degradation arising from resource intensive queries. We propose a risk-adaptive access control model that decouples the process of analyzing resource requirements of sql queries from their execution. We leverage XACML to control users' requests and to monitor database loads. This allows us to adjust available resources in a database system to computing resource needs of queries. A query can therefore run in a database if it does not severely impact the performance of the database. Otherwise, we propose to the requester a replacement query denoted what-if-query. Such query proposes results that are similar to the results of the requester's query, is secure and provides acceptable answers when it executes without compromising the performance of the database.
We propose a business-oriented approach to support accurate and dynamic user-role assignments for... more We propose a business-oriented approach to support accurate and dynamic user-role assignments for the Role Based Access Control (RBAC) model. Our model, called Business-Driven Role Based Access Control (BD-RBAC), is composed of three layers. The first layer extends the RBAC model with the concepts of business roles, system roles, credentials, and users' capabilities. The second layer dynamically assigns users to business and system roles, and filters outdated or abnormal user-role assignments. The third layer supports exception handling and partial authorization. A novel aspect of our work is the adaptation of RBAC-based access control policies to changes in organizational needs, while reducing the burden of security administration. We provide (1) algorithms to compute user-role assignments based on organizational policies, users' requests and capabilities, (2) and show that their outputs are permissible (i.e., the user is authorized to activate the role), complete (i.e., the user can activate the roles necessary to perform all the requested tasks), and minimal (i.e., the user does not receive any non-authorized or not-needed privileges)
In collaborative environments where resources must be shared across multiple sites, the access co... more In collaborative environments where resources must be shared across multiple sites, the access control policies of the participants must be combined in order to define a coherent policy. The relevant challenge in composing access policies is to deal with inconsistencies or modality conflicts. This difficulty exacerbates when the policies to compose are specified independently by different entities with no global power to decide in case of conflicts which entity must take precedence. In this paper, we present a semi-automated framework called Policy Composition and Conflict Resolution framework (P2CR) to address this issue. We focus on access control policies expressed as XACML statements. We propose a three-level conflicts resolution strategy: i.) by using metadata added to the policies, ii.) by using a defeasible logic theory, and iii.) by providing recommendations to the entities owners of the resources. The novelty of this work is threefold. First, we provide a mechanism to add metadata to XACML. Such mechanism allows the entities to express adjustments they are willing to bring in their access policies in a way to prevent potential conflicts during the composition. Second, we combine the access policies without prioritizing any of the entities involved in the composition. Given the context of our work, we consider this approach to be more suitable than the current approaches that are mainly negotiationoriented or assign priorities to the policies. Finally, the resulting composite policy appears flexible and easily adjustable to runtime conflicts.
Large amount of data and increased demand to extract, analyze and derive knowledge from data are ... more Large amount of data and increased demand to extract, analyze and derive knowledge from data are impairing nowadays performance of enterprise missioncritical systems such as databases. For databases, the challenging problem is to manage complex and sometimes nonoptimized queries executed on enormous datasets stored across several tables. This generally results in increased query response time and loss of employees productivity. In this paper, we investigate the problem of enterprise computing resources availability. Our goal is to minimize performance degradation arising from resource intensive queries. We propose a risk-adaptive access control model that decouples the process of analyzing resource requirements of sql queries from their execution. We leverage XACML to control users' requests and to monitor database loads. This allows us to adjust available resources in a database system to computing resource needs of queries. A query can therefore run in a database if it does not severely impact the performance of the database. Otherwise, we propose to the requester a replacement query denoted what-if-query. Such query proposes results that are similar to the results of the requester's query, is secure and provides acceptable answers when it executes without compromising the performance of the database.
IEEE Transactions on Dependable and Secure Computing, 2000
Large amount of data and increased demand to extract, analyze and derive knowledge from data are ... more Large amount of data and increased demand to extract, analyze and derive knowledge from data are impairing nowadays performance of enterprise missioncritical systems such as databases. For databases, the challenging problem is to manage complex and sometimes nonoptimized queries executed on enormous datasets stored across several tables. This generally results in increased query response time and loss of employees productivity. In this paper, we investigate the problem of enterprise computing resources availability. Our goal is to minimize performance degradation arising from resource intensive queries. We propose a risk-adaptive access control model that decouples the process of analyzing resource requirements of sql queries from their execution. We leverage XACML to control users' requests and to monitor database loads. This allows us to adjust available resources in a database system to computing resource needs of queries. A query can therefore run in a database if it does not severely impact the performance of the database. Otherwise, we propose to the requester a replacement query denoted what-if-query. Such query proposes results that are similar to the results of the requester's query, is secure and provides acceptable answers when it executes without compromising the performance of the database.
We propose a business-oriented approach to support accurate and dynamic user-role assignments for... more We propose a business-oriented approach to support accurate and dynamic user-role assignments for the Role Based Access Control (RBAC) model. Our model, called Business-Driven Role Based Access Control (BD-RBAC), is composed of three layers. The first layer extends the RBAC model with the concepts of business roles, system roles, credentials, and users' capabilities. The second layer dynamically assigns users to business and system roles, and filters outdated or abnormal user-role assignments. The third layer supports exception handling and partial authorization. A novel aspect of our work is the adaptation of RBAC-based access control policies to changes in organizational needs, while reducing the burden of security administration. We provide (1) algorithms to compute user-role assignments based on organizational policies, users' requests and capabilities, (2) and show that their outputs are permissible (i.e., the user is authorized to activate the role), complete (i.e., the user can activate the roles necessary to perform all the requested tasks), and minimal (i.e., the user does not receive any non-authorized or not-needed privileges)
In collaborative environments where resources must be shared across multiple sites, the access co... more In collaborative environments where resources must be shared across multiple sites, the access control policies of the participants must be combined in order to define a coherent policy. The relevant challenge in composing access policies is to deal with inconsistencies or modality conflicts. This difficulty exacerbates when the policies to compose are specified independently by different entities with no global power to decide in case of conflicts which entity must take precedence. In this paper, we present a semi-automated framework called Policy Composition and Conflict Resolution framework (P2CR) to address this issue. We focus on access control policies expressed as XACML statements. We propose a three-level conflicts resolution strategy: i.) by using metadata added to the policies, ii.) by using a defeasible logic theory, and iii.) by providing recommendations to the entities owners of the resources. The novelty of this work is threefold. First, we provide a mechanism to add metadata to XACML. Such mechanism allows the entities to express adjustments they are willing to bring in their access policies in a way to prevent potential conflicts during the composition. Second, we combine the access policies without prioritizing any of the entities involved in the composition. Given the context of our work, we consider this approach to be more suitable than the current approaches that are mainly negotiationoriented or assign priorities to the policies. Finally, the resulting composite policy appears flexible and easily adjustable to runtime conflicts.
Large amount of data and increased demand to extract, analyze and derive knowledge from data are ... more Large amount of data and increased demand to extract, analyze and derive knowledge from data are impairing nowadays performance of enterprise missioncritical systems such as databases. For databases, the challenging problem is to manage complex and sometimes nonoptimized queries executed on enormous datasets stored across several tables. This generally results in increased query response time and loss of employees productivity. In this paper, we investigate the problem of enterprise computing resources availability. Our goal is to minimize performance degradation arising from resource intensive queries. We propose a risk-adaptive access control model that decouples the process of analyzing resource requirements of sql queries from their execution. We leverage XACML to control users' requests and to monitor database loads. This allows us to adjust available resources in a database system to computing resource needs of queries. A query can therefore run in a database if it does not severely impact the performance of the database. Otherwise, we propose to the requester a replacement query denoted what-if-query. Such query proposes results that are similar to the results of the requester's query, is secure and provides acceptable answers when it executes without compromising the performance of the database.
Uploads
Papers by Ousmane Dia