I am asked to answer a question but i can't find such info in the internet so i created this post. The problem is:

An on-line paper company decide to give access to their customers depend on their subscription. So the customer read the news depending on what he has pay. There are 3 types of subscriptions: Sports,Food and Music. If a post doesn't belong to any of above subscriptions - categories, then the post is free for everyone. Also if some post of the on-line paper describes a local fact then this post is again free to read from everyone.

a) I have to make a formal presentation of this policy in ABAC.

b) If we have a RBAC(Role-Based Access Control) how many roles we need and what are they?

The only example i have is this:

Basic requirement: access control is based on user’s age and the movies’ content ratings (R, PG-13, G) Advanced requirement: Suppose the store introduces membership classes (Premium, Regular) and would like to enforce a new policy that only Premium users can view New Releases

Basic Policy:

R1: can_access(u,m,e) <-- (Age(u)>= 21 ^ Rating(m) at {R,PG13,G} v (21 >= Age(u) >= 13 ^ Rating(m) at {PG13,G)} v (Age(u) < 13 ^ Rating(m) at {G})

Advanced Policy:

R2: can_access(u,m,e) <-- (MemberType(u) = 'Premium') v (MemberType(u) = 'Regular' ^ MovieType(m) Not at {'NewRelease'})

  • You can use ALFA as a formal policy notation for ABAC – David Brossard Jan 22 '17 at 0:57
  • I am asked to answer the question by using ABAC POLICY RULES.. – CodeL Jan 22 '17 at 8:44
  • ALFA is ABAC. AFAIK this and XACML are the only alternatives – David Brossard Jan 22 '17 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.