An attribute-based access matrix model

Abstract

In traditional access control models like MAC, DAC, and RBAC, authorization decisions are determined according to identities of subjects and objects, which are authenticated by a system completely. Modern access control practices, such as DRM, trust management, and usage control, require flexible authorization policies. In such systems, a subject may be only partially authenticated according to one or more attributes. In this paper we propose an attribute-based access matrix model, named ABAM, which extends the access matrix model. We show that ABAM enhances the expressive power of the access matrix model by supporting attributebased authorizations. Specifically, ABAM is comprehensive enough to encompass traditional access control models as well as some usage control concepts and specifications. On the other side, expressive power and safety are two fundamental but conflictive objectives in an access control model. We study the safety property of ABAM and conclude that the safety problem is decidable for a restricted case where attribute relationships allow no cycles. The restricted case is shown to be reasonable enough to model practical systems.

A Hybrid Attribute based RBAC Model

“…However, when faced with a multi-user, multi-strategy, fine-grained access control environment, RBAC model can not achieve a valid access control result. In order to overcome the shortcomings of the traditional role-based access control mechanism, scholars have launched a lot of research, and proposed multiple access control models, such as TBAC [9,10], T-RBAC [11], OASIS RBAC [12], UCON [13], ABAC [3], RBAC-DC [14], PDAC [15], HBAE [16,17] and etc. In particular, ABAC model introduces the concept of attribute, which makes up for deficiencies in traditional RBAC model, such as: the access control policy is not flexible enough to adapt to the dynamic changes of roles, and the coarse-grained authorization may influence its network adaptability.…”

“…[3,[9][10][11][12][13]16,17] Introducing the dynamic attribute rules, the number of role rules needed by access control is reduced.…”

“…Common access control models are: discretionary Access Control (DAC) model, mandatory access control (MAC) model, RBAC model and attribute-based access control (ABAC) model [1][2][3]. However, compared with the DAC and MAC, RBAC model has better adaptability, and has been widely used in various large-scale access control systems.…”

“…However, compared with the DAC and MAC, RBAC model has better adaptability, and has been widely used in various large-scale access control systems. Furthermore, using the concept of "attribute", ABAC model expands the definition of roles, identifies different subjects by their attribute group, and models different security demands with various relations between attributes, which can effectively solve the problem of fine-grained authorization and dynamic expansion of large-scale users in a distributed environment [3][4][5].…”

Supporting Secure Collaborations with Attribute-based Access Control

“…However, our approach introduces a notion of security token and TP-Functions to capture the mapping between attributes and corresponding access rights. Finally, another interesting approach was presented by Zhang et al [13], who presented their attribute-based access control matrix, which extends classical theory in the field of access control to accommodate attributes as well as the notion of security state. However, it provides no definition for attributebased constraints, which is considered in our approach by means of the proposed TP-Functions and TP-Graphs.…”