X-gtrbac admin

TLDR

Enterprise environments span multiple functional units with diverse authorization needs, and access control policies express these needs as constraints that can conflict across domains, making administration a challenge that requires both user/resource management and conflict resolution for secure interoperation. The study introduces X‑GTRBAC Admin, an administration model designed to manage RBAC policies under constraints while resolving conflicts across multiple domains. The model decentralizes policy administration via abstracted administrative domains, enabling simplified authorization management and decentralized conflict resolution, and is demonstrated with a prototype that supports large‑enterprise policy administration. The prototype demonstrates that the administrative concepts are applicable in realistic large‑enterprise settings, facilitating policy administration.

Abstract

The modern enterprise spans several functional units or administrative domains with diverse authorization requirements. Access control policies in an enterprise environment typically express these requirements as authorization constraints. While desirable for access control, constraints can lead to conflicts in the overall policy in a multidomain environment. The administration problem for enterprise-wide access control, therefore, not only includes authorization management for users and resources within a single domain but also conflict resolution among heterogeneous access control policies of multiple domains to allow secure interoperation within the enterprise. This work presents design and implementation of X-GTRBAC Admin, an administration model that aims at enabling administration of role-based access control (RBAC) policies in the presence of constraints with support for conflict resolution in a multidomain environment. A key feature of the model is that it allows decentralization of policy administration tasks through the abstraction of administrative domains, which not only simplifies authorization management, but is also fundamental to the concept of decentralized conflict resolution presented. The paper also illustrates the applicability of the outlined administrative concepts in a realistic enterprise environment using an implementation prototype that facilitates policy administration in large enterprises.