Policy Administration in Tag-Based Authorization

Sandro Etalle (Eindhoven University of Technology & University of Twente, The Netherlands); Timothy L. Hinrichs (University of Illinois at Chicago, USA); Adam J. Lee (University of Pittsburgh, USA); Daniel Trivellato and Nicola Zannone (Eindhoven University of Technology, The Netherlands)

Tag-Based Authorization (TBA) is a hybrid access control model that combines the ease of use of extensional access control models with the expressivity of logic-based formalisms.The main limitation of TBA is that it lacks support for policy administration. More precisely, it does not allow policy-writers to specify administrative policies that constrain the tags that users can assign, and to verify the compliance of assigned tags with these policies.In this paper we introduce TBA2 (Tag-Based Authorization & Administration), an extension of TBA that enables policy administration in distributed systems. We show that TBA2 is more expressive than TBA and than two reference administrative models proposed in the literature, namely HRU and ARBAC97.

FPS 2012 Program