Attribute Delegation enables users to delegate a subset of their attributes to other users in an 'off-line' manner (not requiring connecting to a third party).įinally, a supporting architecture for HGABAC is detailed including descriptions of services, high-level communication protocols and a new low-level attribute certificate format for exchanging user and connection attributes between independent services. One such strategy is formalized into a new User-to-User Attribute Delegation model, built as an extension to the HGABAC model. Several potential strategies for introducing delegation into ABAC are proposed, categorized into families and the trade-offs of each are examined. HGABAC serves as the basis upon which extensions are built to incorporate delegation into ABAC. It is shown that HGABAC is capable of representing the traditional models of access control (MAC, DAC and RBAC) using this group hierarchy and that in many cases it's use simplifies both attribute and policy administration. The core contribution of this work is the Hierarchical Group and Attribute-Based Access Control (HGABAC) model, a novel formal model of ABAC which introduces the concept of hierarchical user and object attribute groups to ABAC.

This thesis seeks to aid in the adoption of ABAC by filling in several of these gaps. have been largely ignored or left to future work. Issues like delegation, administration, auditability, scalability, hierarchical representations, etc. The relatively recent popularity of ABAC still leaves a number of problems unexplored. However, formalization of a foundational model of ABAC and large-scale adoption is still in its infancy. Discretionary Access Control (DAC), Mandatory Access Control (MAC) and Role-Based Access control (RBAC)) that has drawn attention in both recent academic literature and industry application. Attribute-Based Access Control (ABAC) is a promising alternative to traditional models of access control (i.e.

Smart card toolset pro 3.4.87 key