ReLOG: A Unified Framework for Relationship-Based Access Control over Graph Databases

Relationship-Based Access Control (ReBAC) is a paradigm to specify access constraints in terms of interpersonal relationships. To express these graph-like constraints, a variety of ReBAC models with varying features and ad-hoc implementations have been proposed. In this work, we investigate the theoretical feasibility of realising ReBAC systems using off-the-shelf graph database technology and propose a unified framework through which we characterise and compare existing ReBAC models. To this end, we formalise a ReBAC specific query language, ReLOG, an extension to regular graph queries over property graphs. We show that existing ReBAC models are instantiations of queries over property graphs, laying a foundation for the design of ReBAC mechanisms based on graph database technology.