Relationship-based access control policies and their policy languages

Abstract

The Relationship-Based Access Control (ReBAC) model was recently proposed as a general-purpose access control model. It supports the natural expression of parameterized roles, the composition of policies, and the delegation of trust. Fong proposed a policy language that is based on Modal Logic for expressing and composing ReBAC policies. A natural question is whether such a language is representationally complete, that is, whether the language is capable of expressing all ReBAC policies that one is interested in expressing.In this work, we argue that the extensive use of what we call Relational Policies is what distinguishes ReBAC from traditional access control models. We show that Fong's policy language is representationally incomplete in that certain previously studied Relational Policies are not expressible in the language. We introduce two extensions to the policy language of Fong, and prove that the extended policy language is representationally complete with respect to a well-defined subclass of Relational Policies.

Detecting And Resolving Privacy Conflicts in Online Social Networks using AC2P Protocol

“…So this kind of access specific schemas is being used widely [17] [18].By using this kind of access privacy setting and access control norms will not be suitable for a privacy protection scenario. Some modification needs to be done.By using single controller, the resource-owner, to specify access control policies.…”

A User-to-User Relationship-Based Access Control Model for Online Social Networks

“…In [8], Fong proposed a formal model for social computing applications, in which authorization decisions are based on the user-to-user relationships. This model employs a modal logic language for policy specification.…”

“…This model employs a modal logic language for policy specification. Fong et al extended the policy language and formally characterized its expressiveness power [9]. In contrast to [7], this model allows multiple relationship types and directional relationships.…”

“…Relationships and authorizations are articulated in access contexts and context hierarchy to support sharing of relationships among contexts. Bruns et al [1] later improved [8,9] by using hybrid logic to enable better efficiency in policy evaluation and greater flexibility of atomic formulas.…”

“…The proof is straightforward. New edge is added to currentP ath only when it reaches the target node (lines [8][9][10][11][12] or it may possibly lead to the target…”