Abstract:In every enterprise database, administrators must define an access control policy that specifies which users have access to which assets. Access control straddles two worlds: policy (organization-level principles that define who should have access) and process (database-level primitives that actually implement the policy). Assessing and enforcing process compliance with a policy is a manual and ad-hoc task. This paper introduces a new paradigm for access control called Intent-Based Access Control for Databases (IBAC-DB). In IBAC-DB, access control policies are expressed more precisely using a novel format, the natural language access control matrix (NLACM). Database access control primitives are synthesized automatically from these NLACMs. These primitives can be used to generate new DB configurations and/or evaluate existing ones. This paper presents a reference architecture for an IBAC-DB interface, an initial implementation for PostgreSQL (which we call LLM4AC), and initial benchmarks that evaluate the accuracy and scope of such a system. We further describe how to extend LLM4AC to handle other types of database deployment requirements, including temporal constraints and role hierarchies. We propose RHieSys, a requirement-specific method of extending LLM4AC, and DePLOI, a generalized method of extending LLM4AC. We find that our chosen implementation, LLM4AC, vastly outperforms other baselines, achieving high accuracies and F1 scores on our initial Dr. Spider benchmark. On all systems, we find overall high performance on expanded benchmarks, which include state-of-the-art NL2SQL data requiring external knowledge, and real-world role hierarchies from the Amazon Access dataset.

A Practical Framework for RelBAC Implementation

A Task-Role Based Access Control Model with Multi-Constraints

Design and Implementation of Context-Aware RBAC Model Based on Reasoning

Relation-Based Access Control: an Access Control Model for Context-Aware Computing Environment

The research for spatial role-based access control model

A Semantic and Trust Based Framework for Rbac User-Role Assignment

WARBAC: Improved Administrative Model of Role-Based Access Control

Ontology-Based RBAC specification for interoperation in distributed environment

Realization Method about Access Control of System Based on Web

Using Description Logic to Formalize Role-Based Access Control Model.

A Novel and Effective RBAC-Based Access Control Model in Flexible Information Coding System

Resource and Attribute Based Access Control Model for System with Huge Amounts of Resources.

Intent-Based Access Control: Using LLMs to Intelligently Manage Access Control

Implementation of Parameter Model of PRBAC Based on Attribute Rules

An Administration Model of DRBAC on the Web

Representation and reasoning on RBAC: a description logic approach

A Logic-Based RBAC Framework for Flexible Policies

An Architecture Approach To Dynamic Policy In Rbac

Learning Attribute-Based and Relationship-Based Access Control Policies with Unknown Values

Realization Distributed Access Control Based on Ontology and Attribute with OWL

Managing RBAC states with transitive relations.