Search papers, labs, and topics across Lattice.
This paper introduces LANTERN, a framework leveraging Large Language Models to translate machine-enforceable Attribute-Based Access Control (ABAC) rules extracted from access logs into human-understandable natural language policies. The goal is to bridge the semantic gap between formal logic and human intent in access control. Experiments demonstrate the framework's ability to generate accurate and scalable natural language explanations of ABAC policies.
LLMs can automatically translate complex access control rules into plain English, making security policies understandable to non-experts.
Over the years, access control systems have become increasingly more complex, often causing a disconnect between what is envisaged by the stakeholders in decision-making positions and the actual permissions granted as evidenced from access logs. For instance, Attribute-based Access Control (ABAC), which is a flexible yet complex model typically configured by system security officers, can be made understandable to others only when presented at a high level in natural language. Although several algorithms have been proposed in the literature for automatic extraction of ABAC rules from access logs, there is no attempt yet to bridge the semantic gap between the machine-enforceable formal logic and human-centric policy intent. Our work addresses this problem by developing a framework that generates human understandable natural language access control policies from logs. We investigate to what extent the power of Large Language Models (LLMs) can be harnessed to achieve both accuracy and scalability in the process. Named LANTERN (LLM-based ABAC Natural Translation and Explanation for Rule Navigation), we have instantiated the framework as a publicly accessible web based application for reproducibility of our results.
