Author:
Alexander Lawall
Affiliation:
Hof University, Germany
Keyword(s):
Access Control, Attribute-based Access Control, Language Expressions, Organizational Model, Identity Management.
Related
Ontology
Subjects/Areas/Topics:
Data and Application Security and Privacy
;
Data Engineering
;
Data Management and Quality
;
Data Privacy and Security
;
Databases and Data Security
;
Information and Systems Security
;
Organizational Concepts and Best Practices
Abstract:
In all organizations, access assignments are essential in order to ensure data privacy, permission levels and the correct assignment of tasks. Traditionally, such assignments are based on total enumeration, with the consequence that constant effort has to be put into maintaining the assignments. This problem still persists when using abstraction layers, such as group and role concepts, e.g. Access Control Matrix and Role-Based Access Control. Role and group memberships are statically defined and members have to be added and removed constantly.
This paper describes a novel approach - Hypergraph-Based Access Control HGAC - to assign human and automatic subjects to access rights in a declarative manner.
The approach is based on an organizational (meta-) model and a declarative language. The language is used to express queries and formulate predicates. Queries define sets of subjects based on their properties and their position in the organizational model. They also contain additional
information that causes organizational relations to be active or inactive depending on predicates.
In HGAC, the subjects that have a specific permission are determined by such a query. The query itself is not defined statically but created by traversing a hypergraph path. This allows a structured aggregation of permissions on resources. Consequently, multiple resources can share parts of their queries.
(More)