Interactive Rule Learning for Access Control : Concepts and Design

Nowadays the majority of users are unable toproperly configure security mechanisms mostly because theyare not usable for them. To reach the goal of having usable security mechanisms, the best solution is to minimize the amount of user interactions and simplify configuration tasks. Automation is a proper solution for minimizing the amount of user interaction. Fully automated security systems are possible for most security objectives, with the exception ofthe access control policy generation. Fully automated accesscontrol policy generation is currently not possible because individual preferences must be taken into account and, thus, requires user interaction. To address this problem we proposea mechanism that assists users to generate proper accesscontrol rule sets that reflect their individual preferences. We name this mechanism Interactive Rule Learning for AccessControl (IRL). IRL is designed to generate concise rule setsfor Attribute-Based Access Control (ABAC). The resulting approach leads to adaptive access control rule sets that can be used for so called smart products. Therefore, we first describe the requirements and metrics for usable access control rulesets for smart products. Moreover, we present the design of asecurity component which implements, among other security functionalities, our proposed IRL on ABAC. This design is currently being implemented as part of the ICT 7th Framework Programme SmartProducts of the European Commission