The Hardness of Learning Access Control Policies
| dc.contributor.author | Lei, Xiaomeng | |
| dc.date.accessioned | 2023-08-30T17:12:38Z | |
| dc.date.available | 2023-08-30T17:12:38Z | |
| dc.date.issued | 2023-08-30 | |
| dc.date.submitted | 2023-08-28 | |
| dc.description.abstract | The problem of learning access control policies is gaining significant attention in research. We contribute to the foundations of this problem by posing and addressing meaningful questions on computational hardness. Our study focuses on learning access control policies within three different models: the access matrix, Role-Based Access Control (RBAC), and Relationship-Based Access Control (ReBAC), as described in existing literature. Our approach builds upon the well-established concept of Probably Approximately Correct (PAC) theory, with careful adaptations for our specific context. In our setup, the learning algorithm receives data or examples associated with access enforcement, which involves deciding whether an access request for resource should be accepted or denied. For the access matrix, we pose a learning problem that turns out to be computationally easy, and another that we prove is computationally hard. We generalize the former result so we have a sufficient condition for establishing other problems to be computationally easy. Building upon these findings, we examine five learning problems in the context of RBAC, of which three are identified as computationally easy and two are proven to be computationally hard. Finally, we consider four learning problems in the context of ReBAC, all of which are found to be computationally easy. Every proof for a problem that is computationally easy is constructive, in that we propose a learning algorithm for the problem that is efficient, and probably, approximately correct. As such, our work makes contributions at the foundations of an important, emerging aspect of access control, and thereby, information security. | en |
| dc.identifier.uri | http://hdl.handle.net/10012/19803 | |
| dc.language.iso | en | en |
| dc.pending | false | |
| dc.publisher | University of Waterloo | en |
| dc.title | The Hardness of Learning Access Control Policies | en |
| dc.type | Master Thesis | en |
| uws-etd.degree | Master of Applied Science | en |
| uws-etd.degree.department | Electrical and Computer Engineering | en |
| uws-etd.degree.discipline | Electrical and Computer Engineering | en |
| uws-etd.degree.grantor | University of Waterloo | en |
| uws-etd.embargo.terms | 0 | en |
| uws.contributor.advisor | Tripunitara, Mahesh | |
| uws.contributor.affiliation1 | Faculty of Engineering | en |
| uws.peerReviewStatus | Unreviewed | en |
| uws.published.city | Waterloo | en |
| uws.published.country | Canada | en |
| uws.published.province | Ontario | en |
| uws.scholarLevel | Graduate | en |
| uws.typeOfResource | Text | en |