Path-Aware Access Control: Granting Access with Transit Network Attributes

Access control systems typically evaluate the security aspects of communication endpoints to determine access permission, but they often overlook network-level threats. We argue that access control decisions for remote entities should be made with explicit consideration of the transit network environment. In this study, we propose a novel concept called PAAC, path-aware attribute-based access control, which extends existing endpoint-oriented access decisions by considering transit network information. By incorporating network metrics, the access control system enables finer-grained access control and mitigates network-level threats such as BGP hijacking. Our experiments demonstrate that PAAC achieves comparable performance and scalability to existing attribute-based access control approaches.