Modular Composition of Access Control Policies: A Framework to Build Multi-Site Multi-Level Combinations

We present general notions of access control policy composition using the CBAC model. We show that CBAC provides a uniform framework to define compositions of heterogeneous policies (e.g., RBAC and ABAC policies) as required in many practical situations. Compositions can be built both horizontally (where.. given policies are combined to define a new policy) and vertically (where policies are extended by adding administration layers). We show that under some conditions on the operations used to build the composition, it is possible to ensure that the result preserves desirable properties (such as liveness and effectiveness). We also discuss mechanisms to detect and eliminate conflicts that may arise when composing policies originating from different sources.