ABAC with Group Attributes and Attribute Hierarchies Utilizing the Policy Machine

Abstract

Attribute-Based Access Control (ABAC) has received significant attention in recent years, although the concept has been around for over two decades now. Many ABAC models, with different variations, have been proposed and formalized. Besides basic ABAC models, there are models designed with additional capabilities such as group attributes, group and attribute hierarchies and so on. Hierarchical relationship among groups and attributes enhances access control flexibility and facilitates attribute management and administration. However, implementation and demonstration of ABAC models in real-world applications is still lacking. In this paper, we present a restricted HGABAC (rHGABAC) model with user and object groups and group hierarchy. We then introduce attribute hierarchies in this model. We also present an authorization architecture for implementing rHGABAC utilizing the NIST Policy Machine (PM). PM allows to define attribute-based access control policies, however, the attributes in PM are different in nature than attributes in typical ABAC models as name-value pairs. We identify a policy configuration mechanism for our proposed model employing PM capabilities, and demonstrate use cases and their configuration and implementation in PM using our authorization architecture.

Attribute quality management for dynamic identity and access management

“…[49,53,51]), specific details of actual technical measures are often missing. For ABAC, implementation guidelines with a deep level of technical context already exist [56,57]. We argue that for successful adoption, combining both worlds is required.…”

Attribute Considerations for Access Control Systems

“…The specific attribute value "Person" may be sufficient for accessing data for a public information request but insufficient for access to a sensitive system since the metadata "Level Clearance" is self-reported and not drawn from an authoritative source. To enhance access control flexibility and facilitate attribute management and administration, hierarchical relationships among groups and attributes are usually applied, such that instead of assigning each user/object with the same attributes, the users/objects can be collected into groups with appropriate group metadata and values (i.e., meta-attribute) [12] which represent the common characteristics of the users/objects in the system. Group metadata can also be combined into a higher order group if a group of metadata possesses the same characteristics.…”

Attribute considerations for access control systems

“…The specific attribute value "Person" may be sufficient for accessing data for a public information request but insufficient for access to a sensitive system since the metadata "Clearance Level" is self-reported and not drawn from an authoritative source. To enhance access control flexibility and facilitate attribute management and administration, hierarchical relationships among groups and attributes are usually applied, such that instead of assigning each subject/object with the same attributes, the subjects/objects can be collected into groups with appropriate group metadata and values (i.e., meta-attribute) [13] which represent the common characteristics of the subjects/objects in the system. Group metadata can also be combined into a higher order group if a group of metadata possesses the same characteristics.…”