Extending ABAC Authorisation for Complex Applications: Negative Permissions, Hierarchical Attribute Values, Break Glass Override

Abstract

Much of the commercial and research writings on healthcare Real-Time Location Systems (RTLS) have concentrated on the considerable benefits of this technology for locating assets, patients and staff, with many applications developed, particularly for asset tracking. Less has been written about who is authorised to query and analyse healthcare RTLS data, including historical location data. We categorise use cases for the interactions which have been proposed and indicate further desirable authorisations which could be provided by extending Attribute Based Access Control (ABAC). The ABAC extensions we propose are: to authorise access to information protected at increasing levels of security by invoking break-glass overrides; to enable the denial of access through the use of separately-specified negative permissions, possibly at different levels of security; and supporting hierarchically-structured attribute values for users (e.g., teams and roles), operations and protected objects. We describe algorithms for rule selection and processing, largely at the conceptual level. They take account of architect-specified attribute weightings, the order of rule evaluation, and query modification if the database forms the basis for implementation. We show that our sorting strategy can reduce rule search space by over 90% compared to a naïve policy evaluation, while enabling fine-grained emergency access that current ABAC frameworks lack. We illustrate with an example of technician teams locating and maintaining sophisticated medical equipment in a large healthcare setting. Privacy, confidentiality and security become especially sensitive if technicians need to inspect medical data produced by the equipment, maybe in emergency situations. When fully implemented, our approach does not require additional application programming to provide the extended authorisation functionality described.