KTH-SEECS Applied Information Security Lab

National University of Sciences and Technology (NUST)

Access Control Models, Architecture, Mechanisms and Policies

Of all the major concerns, we are focusing on risks and threats involving access control management. Access control mechanism prevents malicious users from making unauthorized accesses, and is considered an obligatory part of security. It allows data owners to create the required access control policies in order to restrict which users can access what. Maintaining and creating user profiles and access control policies is challenging because the information may come from different sources, using different processes, naming conventions, and technologies, and may need to be transmitted securely between organizations over a hostile Internet. Moreover, there are typically too many technical rules to manage and these rules do not match the understanding of human administrators. Furthermore, these technical rules needs to be updated frequently to remain correct after each time systems change, and it is hard to establish that the level of confidence/assurance of the technical policy enforcement matches the intent of the human administrator. As a consequence, it is critical to carefully plan the tools and processes to make the access policies updating process manageable through automation. Our research effort is towards providing an effective authorization solution for traditional and cloud-hosted applications.

Active players in this field are following: