Challenges of Authorization in a Software System

While discussing security in a software system, lot of attention is given to Authentication, integrity, availability, authenticity, non-repudiation, and confidentiality. But from this list authorization is missing. For authorization simple RBAC (Role based access control) or its variations are widely used. But RBAC does not account for following major aspects in contemporary enterprise systems:

1. Dynamic nature of business objects – dynamically altering attributes, their meanings, and operations as system evolve and flexible nature of architecture and design (for example systems based on template - http://architecture-soa-bpm-eai.blogspot.com/2009/06/template-based-design-technique-part-1.html, http://architecture-soa-bpm-eai.blogspot.com/2009/07/template-based-design-technique-part-2.html, http://architecture-soa-bpm-eai.blogspot.com/2009/12/template-based-design-technique.html).

2. Adhoc demand of access to business objects by users (humans or machines). For example, in case of delegation.

3. Multi dimensional organizational structure on various parameters (hierarchical, project/matrix based, or process based, geographical expanse, etc). This challenge becomes more complicated with realization that each dimension have its own characteristic such as hierarchical structure is a tree structure, matrix structure is graph, and process based is linear. In real enterprise most probably all organizational structure exist at a given point of time.

4. Negative permissions (not to access or do something). Practically in all of the current models only positive permissions are handled but they are silent over negative permissions.

5. Permissions are given on a business object but if permissions are required over particular instance of object then none of the model is capable of solving this challenge.

Although some attempts have been made to address such complex challenge (for example Capability Based security, Brewer and Nash model, etc). But all of these models cover partial of the challenges stated above.