Object-to-Object Relationship-Based Access Control: Model and Multi-Cloud Demonstration (Invited Paper)

Relationship Based Access Control (ReBAC) has been recognized as a distinctive form of access control since the advent of online social networks (OSNs). In the OSN context, ReBAC typically expresses authorization policy in terms of interpersonal relationship between users. OSN-inspired ReBAC models primarily focus on user-to-user relationships, although some have also considered user-to-resource and resource-to-resource relationships. An OSN has very specific type of resources (photos, comments, notes etc.) which are closely related to users, so it is natural to consider resource relationships in OSNs as occurring through users. However user-independent resource-to-resource (or object-to-object) relationships have been around for decades in information systems. For instance, object-oriented systems maintain inheritance, composition and association relationships among objects, version control systems use derived-from relationships between different versions, and digital content management systems use fundamental-relationships between different media files. To our knowledge no existing ReBAC model considers user-independent generic relationships between objects, as a useful means to express authorization policies. This paper proposes a novel Object-to-Object ReBAC model (OOReBAC) which uses object relationships for controlling access to objects. We build a proof-of-concept implementation of OOReBAC using the open source OpenStack cloud platform and specifically its Swift object storage service.