[Paper Review] Relationships, Paths and Principal Matching: A New Approach to Access Control

Jason Crampton, James Sellwood|arXiv (Cornell University)|May 29, 2015

Access Control and Trust15 references3 citations

TL;DR

This paper introduces the Relationships, Paths, and Principal Matching (RPPM) model, a novel access control framework that uses relationship-based policies and path conditions—akin to regular expressions—combined with non-deterministic finite automata to evaluate authorization requests. The model enables expressive, context-aware access control with built-in support for caching, separation of duty, and Chinese Wall policies, significantly improving performance and expressiveness over traditional RBAC and ABAC models.

ABSTRACT

Recent work on relationship-based access control has begun to show how it can be applied to general computing systems, as opposed to simply being employed for social networking applications. The use of relationships to determine authorization policies enables more powerful policies to be defined than those based solely on the commonly used concept of role membership. The relationships, paths and principal matching (RPPM) model described here is a formal access control model using relationships and a two-stage request evaluation process. We make use of path conditions, which are similar to regular expressions, to define policies. We then employ non-deterministic finite automata to determine which policies are applicable to a request. The power and robustness of the RPPM model allows us to include contextual information in the authorization process (through the inclusion of logical entities) and allows us to support desirable policy foundations such as separation of duty and Chinese Wall. Additionally, the RPPM model naturally supports a caching mechanism which has significant impact on request evaluation performance.

Motivation & Objective

• To address the limitations of role-based access control (RBAC) in modeling context-dependent relationships between users and resources.
• To extend relationship-based access control beyond social networks to general-purpose computing systems, including file systems and stateful resources.
• To provide a formal, extensible access control model that supports complex policies such as separation of duty and Chinese Wall using logical entities and historical tracking.
• To improve performance through a native caching mechanism that reuses authorization decisions at the graph level, reducing redundant computation.
• To unify policy expressiveness with efficient evaluation by modeling policies as path conditions and using non-deterministic finite automata for request validation.

Proposed method

• The RPPM model represents subjects, objects, and relationships as nodes and edges in a directed graph, where edges can be labeled with types and include logical (contextual) entities.
• Path conditions are defined as regular-expression-like patterns that specify allowed relationships between principals, including mandatory and excluded targets.
• Authorization requests are evaluated using non-deterministic finite automata (NFA) that traverse the system graph based on path conditions, enabling efficient policy matching.
• The model supports typed edges and audit edges to encode historical access patterns, enabling enforcement of history-dependent policies such as Chinese Wall.
• Caching is implemented by persisting authorization decisions as edges in the system graph, allowing reuse across multiple requests without re-evaluation of the principal-matching process.
• The model integrates administrative principals and rules to support state-modifying operations, such as adding nodes or edges, enabling a complete administrative model.

Experimental results

Research questions

• RQ1 How can access control policies be expressed in a way that captures dynamic, context-sensitive relationships between users and resources beyond static role assignments?
• RQ2 Can a formal access control model be designed to support complex policies like separation of duty and Chinese Wall while remaining efficient and scalable?
• RQ3 To what extent can caching of authorization decisions be integrated into the access control model to reduce runtime evaluation costs?
• RQ4 How can path conditions be formalized to enable both expressive policy specification and efficient algorithmic evaluation using finite automata?
• RQ5 What is the impact of using logical entities and audit edges on modeling stateful and history-dependent access control policies?

Key findings

• The RPPM model supports expressive policy specification through path conditions that are equivalent in power to regular expressions, enabling complex, context-aware access rules.
• The use of non-deterministic finite automata for evaluating path conditions provides a formal and efficient mechanism for request evaluation, with complexity that is analyzable and manageable.
• Caching of authorization decisions at the edge level in the system graph allows for significant performance improvements by reusing previously computed matches across multiple requests.
• The model naturally supports separation of duty and Chinese Wall policies through the use of audit edges and typed relationships, enabling enforcement based on historical access patterns.
• The integration of logical entities into the system graph allows for dynamic context modeling, such as distinguishing between a user’s role in different courses or patient-doctor relationships.
• Preliminary experimental work by the authors demonstrates that the caching mechanism in RPPM leads to tangible and substantial performance gains, especially in high-throughput, distributed environments.