Automated Management of Attribute-Based Policies for Access Control Using Tag-Matching

Data sharing is becoming increasingly important as organizations seek to improve their operations and gain a competitive advantage. The data sharing between organizations, stakeholders, and even internal teams requires access control policies that define who can access what data, under what circumstances, and for what purposes. Attribute-based access control (ABAC) provides a flexible and fine-grained mechanism for enforcing such policies, preventing data leakage, and improving security and compliance. A challenge is that these policies should be able to support the agility and adaptability of constantly evolving modern industrial systems, where new data sources, services, and users are frequently added and removed. As the number of data sources and associated policies grows, the manual management of ABAC policies in evolving systems becomes a bottleneck, which prevents the adoption of fine-grained access control mechanisms. This paper presents a model based on tag-matching to automate the process of connecting new data sources and users to existing access control policies. In the proposed model, tag-matching means matching metadata elements to policy attributes to reduce the administrative work of managing access policies. The model takes advantage of the identity abstraction of ABAC policies to connect existing rules between attributes and the target resource or user. We present a proof-of-concept implementation of the tag-matching model in Eclipse Arrowhead and provide an evaluation of the proposed solution.