Graph-based access control

This sandbox is in the article namespace. Either move this page into your userspace, or remove the {{User sandbox}} template.

Graph-based access control is a rather new technique for granting users of information systems access rights to data objects like files or documents. It can also be used for the assignment of tasks in workflow environments. Organizations are modeled as a specific kind of semantic graph comprising the organizational structure, the roles and functions as well as the agents. Compared to other approaches like RBAC or ABAC the main difference is that in GBAC access rights are defined using an organization query language instead of total enumeration.

History

The foundations of GBAC go back to a research project named CoCoSOrg (Configurable Cooperation System) [^[1]] (in English language please see ^[2]) where the organization graph and a formal language was used to specify agents and their access rights in a workflow environment. Within the project COrg the approach was extended by features like separation of duty, access control in virtual organizations ^[3] and subject-oriented access control ^[4]].

Definition

Graph-based Access Control consists of two building blocks.

• A semantic graph modeling an organization and
• a query language.

Organization Graph

The organization graph is divided into a type and and an instance level. On the instance level there are node types for organization units, functional units and agents. The basic structure of an organization is defined using the so called structural relation that defines which functional units belongs to which organization unit and which agent fulfills which function. Additionally there specific relationship types like deputyship or informs that can be extended by the user. All relationships can be context sensitive via the usage of attributes defining constraints that have to be fulfilled in order for the arc to be valid.

The type level is used for the purpose of re-usage. It consists of organization unit types, functional unit types and the same relationship types as on the instance level. Types are typical organization structures that can be used to create new instances or reuse organization knowledge in case of exceptions (please see next paragraph).

Query Language

In GBAC the query language is used to define a set of agents fulfilling specific attributes. The following table shows how these queries can be used within an access control matrix to specify access rights to data objects. The first query means that all managers working for the company for more than a half year can read the financial report and additionally the managers that are empowered by the usage of specific flag. The daily financial report can only be written by the manager of the controlling department or clerk of the department with a specific flag.

Data Object	Read	Write
Daily Financial Report	Manager(*).(Now() - Manager.HiringYear() > 0.5 OR Manager.ReadFinancialReport == TRUE	Manager(Controlling) or Clerk(Controlling).WriteFinancialReport==TRUE

Implementation

The organization graph is maintained by an organization server. This server accepts queries according to the syntax of the organization language. A query is resolved to a set of agents that is send to the calling client as response.

See also

RBAC Hypergraph-based Access Control

References

1. Schaller, Thomas (1998). Organisationsverwaltung in CSCW-Systemen. Bamberg: Bamberg University.
2. Lawall, Schaller, Reichelt (2014). Enterprise Architecture: A Formalism for Modelling Organizational Structures in Information Systems. Thessaloniki: Enterprise and Organizatinal Modeling and Simulation: 10th International Workshop CAiSE2014.
3. Lawall, Schaller, Reichelt (2014). "Restricted Relations between Organizations for Cross-Organizational Processes". IEEE 16th Conference on Business Informatics (CBI),Geneva: 74–80. [
4. Lawall, Schaller, Reichelt (2015). S-BPM in the Wild: Role and Rights Management (1 ed.). Berlin: Springer. pp. 171–186. ISBN 978-3-319-17541-6.