2015/05/29 by Jason Crampton, Crampton, Jason, James Sellwood +1
Computer Science · Social Sciences · #Access Control and Trust #Cryptography and Data Security #Cryptography and Security (cs.CR) #D.4.6 #FOS: Computer and information sciences #H.2.0 #Internet Traffic Analysis and Secure E-voting #cs.CR
paper · pdf · doi:10.48550/arxiv.1505.07945
openalex publication_date 2015/05/29 · arxiv created 2015/09/19 · arxiv updated 2015/09/22 · openalex created_date 2016/06/24 · openalex updated_date 2026/07/28
Recent work on relationship-based access control has begun to show how it can be applied to general computing systems, as opposed to simply being employed for social networking applications. The use of relationships to determine authorization policies enables more powerful policies to be defined than those based solely on the commonly used concept of role membership. The relationships, paths and principal matching (RPPM) model described here is a formal access control model using relationships and a two-stage request evaluation process. We make use of path conditions, which are similar to regular expressions, to define policies. We then employ non-deterministic finite automata to determine which policies are applicable to a request. The power and robustness of the RPPM model allows us to include contextual information in the authorization process (through the inclusion of logical entities) and allows us to support desirable policy foundations such as separation of duty and Chinese Wall. Additionally, the RPPM model naturally supports a caching mechanism which has significant impact on request evaluation performance.