Concrete- and abstract-based access control

Abstract

Access control models allow expressing access control rules (also called policies) stating that certain subjects (or users) have or do not have the right (or privilege) to access certain objects in order to execute certain actions under certain conditions. Several existing models allow expressing rules only for specific subjects, objects and actions. Rolebased access control (RBAC) introduced the notion of role, which is an abstraction over subjects. Organization-based access control (OrBAC) generalized further, by allowing specifying rules involving abstract subjects, abstract actions and abstract objects. We propose here a model that allows expressing rules involving any combinations of abstract or concrete subjects, actions and objects, as well as conditions over them. For this reason, our model is called concrete-and abstract-based access control model (CABAC). The semantics of our model is expressed in terms of first order predicate logic. Temporal, spatial, knowledge and historical contexts can be specified and combined. We show how in this model it is possible to express hierarchies of subjects, objects and actions as well as propagation of policies over hierarchies. Further, while in most models subjects, objects and actions, whether concrete or abstract, must be specified statically, it is possible in our model to specify subjects, actions and objects dynamically, i.e., according to conditions that can vary over time. Access control rules can also be explicitly revoked and Y. Bouzida · L. Logrippo (B) Université du Québec en Outaouais,

Designing flexible access control models for the cloud

“…These developments have motivated our approach that provides support for modeling the basic concepts of the DAC, MAC, RBAC, ABAC models, as well as combinations of them, based on the category notion. Our meta-model is a generalization of the work of Barker [3,4] since it proposes a categorization of all the basic elements of access control while adding the notion of Work that is close to ours on the conceptual level is that of OrBAC [1], together with its extension in [6]. OrBAC proposes an abstract level between role, activity and view.…”