  Recent work on relationship-based access control has begun to show how it can
be applied to general computing systems, as opposed to simply being employed
for social networking applications. The use of relationships to determine
authorization policies enables more powerful policies to be defined than those
based solely on the commonly used concept of role membership. The
relationships, paths and principal matching (RPPM) model described here is a
formal access control model using relationships and a two-stage request
evaluation process. We make use of path conditions, which are similar to
regular expressions, to define policies. We then employ non-deterministic
finite automata to determine which policies are applicable to a request. The
power and robustness of the RPPM model allows us to include contextual
information in the authorization process (through the inclusion of logical
entities) and allows us to support desirable policy foundations such as
separation of duty and Chinese Wall. Additionally, the RPPM model naturally
supports a caching mechanism which has significant impact on request evaluation
performance.
