Path Dependencies in Bilateral Relationship-Based Access Control

The Relationship-based Access Control Model (ReBAC) generalizes Role-based Access Control (RBAC) by considering both hierarchical and non-hierarchical relationships between users to specify access control of a set of target resources (objects). This paper extends the ReBAC model by considering relationships between objects as well as between subjects and objects. This generalized model is expressed through the language of dependencies borrowed from data management. We develop a language for bilateral path dependencies which states that a chain of binary relationships over subjects and objects logically implies another chain of binary relationships. We show that this formalism is adequate to capture access control rules with no conflicts. In future work, this formalism will be extended to include conflict detection and resolution.