Access control

December 13, 2016

Strategies

  1. Tagged access control
  2. Context-based access control
  3. Context-based tagged access control

Tagged access control

Tagged access control is an approach to decoupling authorization logic from data models used to represent users and resources. This makes it trivially easy to support both changes and additions to user and resource data models over time.

Given a user, some actions, and a resource:

 O                    .
-+-      <access>     ├── dir1
 |                    |   └── file1
/ \      <modify>     └── file2

User      Actions     Resources

The user is granted access to perform certain actions for certain tags:

          access
 O  -----------------> tagX, tagY
-+- 
 |        modify
/ \ -----------------> tagY

User      Actions      Tags

The resource is marked with a tag:

.
├── dir1      ---------> tagX
|   └── file1 ---------> tagX
└── file2     ---------> tagY

Resource                 Tag

The user may perform an action on a resource if they have access to the resource's tag:

Context-based access control

Context-based access control addresses the need to limit access levels based on domain-specific constraints, such as the audience present, the networks utilized, the location occupied, etc.

Given two users, two resources, and access levels:

  O          .                  O
 -+- ------> ├── file1         -+-
  |  ------> ├── file2 <------  |
 / \         └── file3 <------ / \

User1        Resources        User2

If User1 and User2 are having a conversation, they are limited to discussing file2, since the intersection of their accesses excludes file1 and file3.

This also works for grantees that aren't users:

  O          .                 .~~~~~~.
 -+- ------> ├── file1         ;      ;
  |  ------> ├── file2 <------ ;      ;
 / \         └── file3 <------ '~~~~~~'

User1        Resources        Office LAN

If User1 needs to access file2, it must be done from Office LAN, since only the intersection of their accesses includes file2.