Patterns for session-based access control

Abstract

The concept of session, the context under which a user accesses resources is very important to apply access control. We present first the Controlled Access Session pattern for describing how sessions can limit the rights of a user. We then combine this pattern with two existing access control patterns. First we consider a pattern for Session-Based Role-Based Access Control, intended for organizations in which job functions form the basis for privilege assignments. Then, we present a Session-Based Attribute-Based Access Control pattern for organizations in which accesses are controlled based on values of user attributes and object properties. Since the general properties of those patterns have been described earlier we emphasize the additional effect of using sessions. The Controlled Access Session pattern can also be combined with other models of access control or used on its own. Copyright 2006 ACM.