Information Flow-Based Security Levels Assessment for Access Control Systems

Access control systems are designed to allow or deny access to data according to organizational policies. In many organizations, the access rights of subjects to data objects are determined in consideration of clearance levels of subjects and classification levels of objects. In most formally-defined traditional access control systems, levels are predetermined and policies are rigid. However, in practice organizations need to use flexible methods where the levels are determined dynamically by information flow criteria. In this paper, we develop a method that is both formal and flexible to determine entities’ security levels on the basis of access history, which characterizes the data that subjects can know or objects can contain. Our approach is motivated with a number of different examples, showing that the method meets real-life organizational requirements.