Complex Subjects, or: The Striving for Complexity is Ruling our World

In the course of the emergence of more complicated data models, which are used in the database world, more elaborate access control schemes are required as well. Security models have to be developed that are at least at the same level of abstraction as the data they have to deal with and the policies they have to enforce. We describe a role-based authorisation scheme for object-oriented data models which makes heavy use of implicit authorisations and which includes a domain concept. However, the main contribution of this paper is not to explain yet another access control scheme for such kinds of data models (there are already enough), but to discuss some mechanisms which allow the number of explicit access rights to be reduced as much as is meaningful by means of implicit authorisations, composite subjects and negative authorisations. Since negative authorisations (or prohibitions) are a bone of contention within the security community, we discuss some alternatives to avoid them without piling up explicit access rights. On the other hand, we consider some examples where negative authorisations are inevitable, because of their particular semantics. Hence, we argue for having both, composite subjects and prohibitions. Furthermore, we discuss compound subjects to realise some access control policies that are required by many real-world applications, e.g. four-eyes principles (or n-person rules). Complex subjects refer to both composite and compound subjects. Keyword Codes: K.6.5; H.2.7