AGABAC: Implementing and Evaluating an Attribute-Group Access Control Model for Secure Web-Based Spreadsheet Interfaces in Large-Scale e-Government Systems

As e-government systems grow in scale and complexity, securing access to their dynamic information resources has become increasingly difficult. We’ve observed a particular challenge emerging with the widespread adoption of web-based spreadsheet interfaces for data analysis and reporting. While these tools offer valuable flexibility, implementing practical and fine-grained access control for them remains an open problem. Traditional Attribute-Based Access Control (ABAC) models, though flexible in theory, become administratively burdensome in practice due to the combinatorial explosion of attribute relationships (m×n×k). Furthermore, they lack a formal way to define permissions for specific spreadsheet elements like individual cells or ranges. In this paper, we present AGABAC (Attribute-Group ABAC), a new model that addresses these limitations through two key contributions. First, we introduce an attribute-grouping mechanism that dramatically reduces policy management overhead. Second, we’ve created a formalized model specifically designed for controlling access to dynamic spreadsheet operations. To validate our approach, we built a complete prototype and conducted thorough experiments comparing AGABAC against standard ABAC and RBAC models. The results are promising: AGABAC reduced policy configuration time by 47% compared to standard ABAC, while maintaining access decision times under 15ms even with 10,000 concurrent users. These findings suggest that AGABAC offers a practical solution for implementing efficient and secure access control in large-scale e-government systems.