Path Conditions and Principal Matching: A New Approach to Access Control

TL;DR

This paper introduces a relationship-based access control model using path conditions, providing a formal, efficient method for evaluating policies that focus on entity relationships rather than user identities.

Contribution

It develops a novel formal model and evaluation algorithm for relationship-based access control using path conditions, extending social network ideas to general computing systems.

Findings

Formal semantics for path conditions established

Algorithm for policy evaluation developed and analyzed

Preliminary implementation demonstrates model's advantages

Abstract

Traditional authorization policies are user-centric, in the sense that authorization is defined, ultimately, in terms of user identities. We believe that this user-centric approach is inappropriate for many applications, and that what should determine authorization is the relationships that exist between entities in the system. While recent research has considered the possibility of specifying authorization policies based on the relationships that exist between peers in social networks, we are not aware of the application of these ideas to general computing systems. We develop a formal access control model that makes use of ideas from relationship-based access control and a two-stage method for evaluating policies. Our policies are defined using path conditions, which are similar to regular expressions. We define semantics for path conditions, which we use to develop a rigorous method for evaluating policies. We describe the algorithm required to evaluate policies and establish its complexity. Finally, we illustrate the advantages of our model using an example and describe a preliminary implementation of our algorithm.