Content deleted Content added
Suntooooth (talk | contribs) Changing short description from "Access control paradigm where access is evaluated based on attributes related to the subject, the object, requested operations and in some cases environmental attributes" to "Access control paradigm" |
No edit summary |
||
Line 6:
Unlike [[RBAC|role-based access control (RBAC)]], which defines roles that carry a specific set of privileges associated with them and to which subjects are assigned, ABAC can express complex rule sets that can evaluate many different attributes. Through defining consistent subject and object attributes into security policies, ABAC eliminates the need for explicit authorizations to individuals’ subjects needed in a non-ABAC access method, reducing the complexity of managing access lists and groups.
Attribute values can be set-valued or atomic-valued. Set-valued attributes contain more than one atomic value. Examples are ''role'' and ''project''. Atomic-valued attributes contain only one atomic value. Examples are ''clearance'' and ''sensitivity''. Attributes can be compared to static values or to one another, thus enabling relation-based access control.{{Citation needed|date=September 2023}}
Although the concept itself existed for many years, ABAC is considered a "next generation" authorization model because it provides dynamic, context-aware and risk-intelligent access control to resources allowing access control policies that include specific attributes from many different information systems to be defined to resolve an authorization and achieve an efficient regulatory compliance, allowing enterprises flexibility in their implementations based on their existing infrastructures.
Line 44:
Historically, access control models have included [[mandatory access control]] (MAC), [[discretionary access control]] (DAC), and more recently [[role-based access control]] (RBAC). These access control models are user-centric and do not take into account additional parameters such as resource information, the relationship between the user (the requesting entity) and the resource, and dynamic information, e.g. time of the day or user IP.
ABAC tries to address this by defining access control based on attributes which describe the requesting entity (the user), the targeted object or resource, the desired action (view, edit, delete), and environmental or contextual information. This is why access control is said to be attribute-based.<ref>{{Cite web |title=What Is Attribute-Based Access Control (ABAC)? |url=https://www.okta.com/blog/2020/09/attribute-based-access-control-abac/ |access-date=2023-09-13 |website=www.okta.com |language=en}}</ref>
==Implementations==
| |||