Graph-based access control: Difference between revisions

Revision as of 10:30, 15 July 2015

Latest revision as of 02:27, 12 August 2024

(58 intermediate revisions by 25 users not shown)

Line 1:

'''Graph-based access control''' ('''GBAC''') is a rather[[declarative newprogramming|declarative]] techniqueway forto grantingdefine users[[access ofcontrol|access rights]], task assignments, recipients and content in [[information systemssystem]]s. accessAccess rights are granted to objects like files or documents, but also business objects likesuch as an account. ItGBAC can also be used for the assignment of agents to tasks in workflow environments. Organizations are modeled as a specific kind of semantic graph comprising the organizational units, the roles and functions as well as the human and automatic agents (i.a. Comparedpersons, tomachines). The main difference with other approaches likesuch as [[RBACrole-based access control]] or [[Attributeattribute-based_access_control|ABACbased access control]] the main difference is that in GBAC access rights are defined using an organizationorganizational query language instead of total enumeration.

{{User sandbox}}

<!-- EDIT BELOW THIS LINE -->

Graph-based access control (GBAC) is a rather new technique for granting users of information systems access rights to objects like files or documents but also business objects like an account. It can also be used for the assignment of tasks in workflow environments. Organizations are modeled as a specific kind of semantic graph comprising the organizational units, the roles and functions as well as the agents. Compared to other approaches like [[RBAC]] or [[Attribute-based_access_control|ABAC]] the main difference is that in GBAC access rights are defined using an organization query language instead of total enumeration.

== History ==

The foundations of GBAC go back to a research project named CoCoSOrg (Configurable Cooperation System) [<ref name = "DISS">{{cite book |last1=Schaller |first1=Thomas |url=https://www.researchgate.net/publication/220690241 |title=Organisationsverwaltung in CSCW-Systemen - Dissertation |date=1998 |publisher=Bamberg University |___location=Bamberg}}</ref>] (in English language please see <ref name = "EOMAS">{{cite book |last1=Lawall, Schaller, Reichelt |url=https://www.researchgate.net/publication/283579217 |title=Enterprise Architecture: A Formalism for Modelling Organizational Structures in Information Systems |date=2014 |publisher=Enterprise and Organizatinal Modeling and Simulation: 10th International Workshop CAiSE2014 |___location=Thessaloniki}}</ref>) whereat Bamberg University. In CoCoSOrg an organization wasis modeledrepresented as a semantic graph and a formal language wasis used to specify agents and their access rights in a workflow environment. Within the project C-Org-Project at Hof UniversitiesUniversity's Institute for Information Systems ([http://www.iisys.de/en/research/research-groups/information-management.html iisys]), the approach was extended by features like separation of duty, access control in virtual organizations <ref>{{cite journal|last1=Lawall, Schaller, Reichelt|title=Restricted Relations between Organizations for Cross-Organizational Processes|journal=IEEE 16th Conference on Business Informatics (CBI), Geneva|date=2014|pages=74-8074–80}} [</ref> and subject-oriented access control .<ref>{{cite book|last1=Lawall, Schaller, Reichelt|title=S-BPM in the Wild: Role and Rights Management|date=2015|publisher=Springer|___location=Berlin|isbn=978-3-319-17541-6|pages=171-186171–186|edition=1}}</ref>].

The foundations of GBAC go back to a research project named CoCoSOrg (Configurable Cooperation System) [<ref name = DISS>{{cite book|last1=Schaller|first1=Thomas|title=Organisationsverwaltung in CSCW-Systemen - Dissertation|date=1998|publisher=Bamberg University|___location=Bamberg}}</ref>] (in English language please see <ref name = EOMAS>{{cite book|last1=Lawall, Schaller, Reichelt|title=Enterprise Architecture: A Formalism for Modelling Organizational Structures in Information Systems|date=2014|publisher=Enterprise and Organizatinal Modeling and Simulation: 10th International Workshop CAiSE2014|___location=Thessaloniki}}</ref>) where an organization was modeled as a semantic graph and a formal language was used to specify agents and their access rights in a workflow environment. Within the project C-Org-Project at Hof Universities Institute for Information Systems (iisys) the approach was extended by features like separation of duty, access control in virtual organizations <ref>{{cite journal|last1=Lawall, Schaller, Reichelt|title=Restricted Relations between Organizations for Cross-Organizational Processes|journal=IEEE 16th Conference on Business Informatics (CBI),Geneva|date=2014|pages=74-80}} [</ref> and subject-oriented access control <ref>{{cite book|last1=Lawall, Schaller, Reichelt|title=S-BPM in the Wild: Role and Rights Management|date=2015|publisher=Springer|___location=Berlin|isbn=978-3-319-17541-6|pages=171-186|edition=1}}</ref>].

== Definition ==

Graph-based Accessaccess Controlcontrol consists of two building blocks:

* A semantic graph modeling an organization and

* aA query language.

=== Organizational graph ===

Graph-based Access Control consists of two building blocks:

[[File:GBACOrgGraph.pdf|thumb|OrganizationOrganizational Graph in GBAC]]

* A semantic graph modeling an organization and

* a query language.

The organizationorganizational graph is divided into a type and an instance level. On the instance level there are node types for organizationorganizational units, functional units and agents. The basic structure of an organization is defined using the so called ″structural"structural relation″relations". definingThey define the ″is"is part of″of"- relations between functional units and organizationorganizational unitunits as well as the mapping of agents to functional units. Additionally there are specific relationship types like ″deputyship″"deputyship" or ″informs″"informed_by". thatThese types can be extended by the usermodeler. All relationships can be context sensitive viathrough the usage of predicates[[Predicate defining(mathematical constraints that have to be true in order for the arc to be validlogic)|predicate]]s.

==== Organization Graph ====

TheOn the type level isorganizational usedstructures forare thedescribed purposein ofa re-usagemore general manner. It consists of organizationorganizational unit types, functional unit types and the same relationship types as on the instance level. TypesType are typical organization structures thatdefinitions can be used to create new instances or reuse organizationorganizational knowledge in case of exceptions (for further reading see <ref name=DISS/> <ref name=EOMAS />).

[[File:GBACOrgGraph.pdf|thumb|Organization Graph in GBAC]]

==== Query Languagelanguage ====

The organization graph is divided into a type and an instance level. On the instance level there are node types for organization units, functional units and agents. The basic structure of an organization is defined using the so called ″structural relation″ defining the ″is part of″- relations between functional units and organization unit as well as the mapping of agents to functional units. Additionally there are specific relationship types like ″deputyship″ or ″informs″ that can be extended by the user. All relationships can be context sensitive via the usage of predicates defining constraints that have to be true in order for the arc to be valid.

In GBAC a query language is used to define aagents sethaving ofcertain agentscharacteristics fulfillingor specific attributesabilities. The following table shows the usage of the query language withinin the context of an access control matrix.

The first query means that all managers working for the company for more than asix half yearmonths can read the financial report, andas additionallywell as the managers thatwho are classified by a specificthe flag. "ReadFinancialReport".

The type level is used for the purpose of re-usage. It consists of organization unit types, functional unit types and the same relationship types as on the instance level. Types are typical organization structures that can be used to create new instances or reuse organization knowledge in case of exceptions (for further reading see <ref name=DISS/> <ref name=EOMAS />).

The daily financial report can only be written by the manager of the controlling department or clerks of the department that haveare theenabled explicitto writedo rightthat (WriteFinancialReport==TRUE).

==== Query Language ====

In GBAC a query language is used to define a set of agents fulfilling specific attributes. The following table shows the usage of the query language within an access control matrix.

The first query means that all managers working for the company for more than a half year can read the financial report and additionally the managers that are classified by a specific flag.

The daily financial report can only be written by the manager of the controlling department or clerks of the department that have the explicit write right (WriteFinancialReport==TRUE).

{| class="wikitable"

Line 32 ⟶ 27:

! Data Object !! Read !! Write

|-

| Daily Financial Report || Manager(*).(Now() - Manager.HiringYear() > 0.5) OR Manager.ReadFinancialReport == TRUE || Manager(Controlling) orOR Clerk(Controlling).WriteFinancialReport == TRUE

|}

== Implementation ==

[[File:CORGUsage.jpg|thumb|Usage of CORGC-Org]]

GBAC was first implemented in the CoCoS Environment within the organizational server CoCoSOrg.<ref name=DISS />

[[File:CORGUsage.jpg|thumb|Usage of CORG]]

In the C-Org-Project it was extended with more sophisticated features like separation of duty or access control in distributed environments.

There is also a cloud-based implementation<ref>{{Cite book |last1=Lawall |first1=Alexander |last2=Reichelt |first2=Dominik |last3=Schaller |first3=Thomas |chapter=Resource management and authorization for cloud services |date=2015-04-23 |title=Proceedings of the 7th International Conference on Subject-Oriented Business Process Management |chapter-url=https://doi.org/10.1145/2723839.2723864 |series=S-BPM ONE '15 |___location=New York, NY, USA |publisher=Association for Computing Machinery |pages=18:1–18:8 |doi=10.1145/2723839.2723864 |isbn=978-1-4503-3312-2}}</ref> on IBM's [[Bluemix]]<ref>[http://www.ibm.com/cloud-computing/bluemix/?cm_mmc=search-gsn-_-branded-Bluemix-general-_-ibm%20bluemix-_-ger-bm-mkt-oww Bluemix]</ref> platform.

In all implementations the server takes a query from a client system and resolves it to a set of agents. This set is sent back to the calling client as response. Clients can be file systems, database management systems, workflow management systems, physical security systems or even telephone servers.

The C-Org Server maintains the organization graph and accepts queries according to the syntax of the organization language.

After receiving, a query is resolved to a set of agents that is send back to the calling client as response.

Clients of C-Org can be file systems, database management systems, workflow management systems, physical security systems or even telephone servers. C-Org was also implemented as service on IBM's bluemix platform.

== See also ==

{{columns-list|colwidth=30em|

* [[RBAC]]

* Hypergraph-based [[Access Controlcontrol list]]

* [[Attribute-based access control]] (ABAC)

* [[Capability-based security]]

* [[Context-based access control]] (CBAC)

* [[Discretionary access control]] (DAC)

* [[Lattice-based access control]] (LBAC)

* [[Mandatory access control]] (MAC)

* [[Organisation-based access control]] (OrBAC)

* [[Risk-based authentication]]

* [[Role-based access control]] (RBAC)

* [[RSBAC|Rule-set-based access control (RSBAC)]]

}}

== References ==

<references/>

[[Category:Access control]]

[[Category:Computer access control]]