Abstract
The RPPM model of access control uses relationships, paths and principal-matching in order to make access control decisions for general computing systems. Recently Stoller introduced a variant of an early RPPM model supporting administrative actions. Stoller's RPPM$^2$ model is able to make authorization decisions in respect of actions which affect the system graph and some policy elements.
We also see utility in the RPPM model and believe that providing effective administration of the access control model is key to increasing the model's usefulness to real-world implementations. However, whilst we find inspiration in some aspects of Stoller's work, we believe that an alternative approach making use of the latest RPPM model as its basis will offer a wider range of operational and administrative capabilities.
We motivate this work with specific requirements for an administrative model and then propose a decentralised discretionary access control approach to administration, whereby users are able to manage model components in the system graph through the addition and deletion of edges. The resulting Administrative RPPM (ARPPM) model supports administration of all of the model's components: the system model, the system graph, the authorization policies and all of their elements
We also see utility in the RPPM model and believe that providing effective administration of the access control model is key to increasing the model's usefulness to real-world implementations. However, whilst we find inspiration in some aspects of Stoller's work, we believe that an alternative approach making use of the latest RPPM model as its basis will offer a wider range of operational and administrative capabilities.
We motivate this work with specific requirements for an administrative model and then propose a decentralised discretionary access control approach to administration, whereby users are able to manage model components in the system graph through the addition and deletion of edges. The resulting Administrative RPPM (ARPPM) model supports administration of all of the model's components: the system model, the system graph, the authorization policies and all of their elements
Original language | English |
---|---|
Title of host publication | CODASPY 2016 - Proceedings of the 6th ACM Conference on Data and Application Security and Privacy |
Publisher | ACM |
Pages | 219-230 |
Number of pages | 12 |
ISBN (Print) | 9781450339353 |
DOIs | |
Publication status | Published - 9 Mar 2016 |
Event | 6th ACM Conference on Data and Application Security and Privacy, CODASPY 2016 - New Orleans, United States Duration: 9 Mar 2016 → 11 Mar 2016 |
Conference
Conference | 6th ACM Conference on Data and Application Security and Privacy, CODASPY 2016 |
---|---|
Country/Territory | United States |
City | New Orleans |
Period | 9/03/16 → 11/03/16 |
Keywords
- Access control
- Administration
- Authorization
- Entity condition
- Path condition
- Principal matching
- Relationship