Attribute-based access control (ABAC) has been proposed as a highly flexible method for providing access based on the evaluation of attributes (user attributes, resource attributes, environment attribute, etc.). ABAC generalizes traditional access control models (DAC, MAC, and RBAC), and is considered to be more flexible, scalable, and secure in dynamic environments where the number of users is very high, than those models. On the other hand, development of ABAC is in its early stage and there is no agreement on a formal ABAC model. Some recent proposals are operational models ABACα and ABACβ, and an administrative model GURA.

Formal description of access control is extremely important, since it should be defined, unambiguously, how rules regulate what action can be performed by an entity on the resource, how to guarantee that each request gets an authorization decision, how to ensure consistency, etc. We aim at specifying ABAC operational and administrative models in a formalism, which combines the power of conditional rewriting and logic programming, based on the ρLog calculus. Advantages of using such an approach are that rule-based formalisms are expressive with clean declarative semantics, they can be conveniently used for analyzing and proving policy properties, for composing policies, and for answering administrative queries. Besides, there exist various rule-based tools that can be used for rapid prototyping and experimenting.

Project members:

• Mircea Marin (Principal Investigator)

• Mikheil Rukhaia (Coordinator)

• Temur Kutsia (Key Personnel)

• Besik Dundua (Key Personnel)