## 3 Preliminaries  
### Basic Components of ABAC  
According to the NIST standard for ABAC systems ([PERSON] et al., 2019), we present the basic components of ABAC as follows:1. \(U\) represents a finite set of requesting users. Each element of the set is denoted as \(u_{i}\), where \(1\leq i\leq|U|\). 2. \(O\) represents a finite set of requested objects. Each element of the set is denoted as \(o_{i}\), where \(1\leq i\leq|O|\). 3. \(OP\) represents a finite set of the operations allowed to be performed on the objects in an ABAC system. Each element of the set is denoted as \(op_{i}\), where \(1\leq i\leq|OP|\). For instance, if there are only two operations allowed in a system: _read_ and _write_, then we represent \(\text{OP}=\{\textit{read},\textit{write}\}\). 4. \(E\) represents a finite set of environments in which authorizations are made, such as time and locations. These authorizations are independent of users and objects. Each element of the set is denoted as \(e_{i}\), where \(1\leq i\leq|E|\). 5. \(UA\) represents a finite set of attribute names of users. Each element of the set is denoted as \(ua_{i}\), where \(1\leq i\leq|UA|\). User attribute \(ua_{i}\) can associate several values. If we use \(Val_{ua_{i}}\) to represent the one-to-many mapping of \(ua_{i}\) onto a set of attribute values, it can be formalized as: \[\forall ua_{i}\in UA:Val_{ua_{i}}=\left\{val_{ij}^{u}\middle|1\leq j\leq n_{i}^ {u},n_{i}^{u}\in Z^{+}\right\}\cup\{null\},\] (1) where \(null\) indicates that the corresponding attribute values of the user is unknown or uncertain. For instance, user attribute \(Role\) in a hospital can take values of Doctor, Nurse, and Patient, and then we represent \(Val_{Role}=\{\text{Doctor},\text{ Nurse},\text{ Patient}\}\). 6. \(UAV\) represents a finite set of all the possible attribute name-value pairs of users. Each element of the set is denoted in the form of the equality \(ua_{i}=x_{i}\), where \(ua_{i}\in UA\), \(x_{i}\in Val_{ua_{i}}\). For instance, if there are two attributes of users: \(Role\) and \(Specialty\), where \(Role\) can take values of Doctor, Nurse and Patient, and \(Specialty\) can take values of Cardiology, Medicine, and Pediatric, then \(UAV\) is represented as: \(\{Role=\text{Doctor},\text{ }Role=\text{ Nurse},\text{ }Role=\text{Patient},\text{ }Specialty=\text{ Cardiology},\text{ }Specialty=\text{Medicine},\text{ }Specialty=\text{ Pediatric}\}\). 7. \(UUAV\subseteq U\times UAV\) represents a many-to-many assignment of users to their attribute name-value pairs. It can be formalized as: \[UUAV=\{(u_{k}:ua_{1}=x_{1},ua_{2}=x_{2},\ldots,ua_{i}=x_{i},\ldots)\big{|}u_{ k}\in U,(ua_{i}=x_{i})\in UAV\}.\] (2)
8. \(OA\) represents a finite set of attribute names of objects. Each element of the set is denoted as \(oa_{i}\), where \(1\leq i\leq|OA|\). The object attribute \(oa_{i}\) is also associated with several values. If we use \(Val_{oa_{i}}\) to represent the one-to-many mapping of \(oa_{i}\) onto a set of attribute values, it can be formalized as: \[\forall oa_{i}\in OA:Val_{oa_{i}}=\left\{val_{ij}^{o}\middle|1\leq j\leq n_{i}^ {o},n_{i}^{o}\in Z^{+}\right\}\cup\{null\}\] (3) where \(null\) indicates that the corresponding attribute values of the object is unknown or uncertain. For instance, object attribute \(Department\) in a hospital can take values of Cardiology, Dermatology, and Gynecology, and then we represent \(Val_{Department}=\{\text{Cardiology},\text{ }Dermatology,\text{ }Gynecology\}\). 9. \(OAV\) represents a finite set of all the possible attribute name-value pairs of objects. Each element of the set is denoted in the form of the equality \(oa_{i}=y_{i}\), where \(oa_{i}\in OA\), \(y_{i}\in Val_{oa_{i}}\).