Managing Role-Based Access Control Policies for Grid Databases in OGSA-DAI Using CAS

In this paper, we propose a role-based access control (RBAC) system for data resources in the Storage Resource Broker (SRB). The SRB is a Data Grid management system, which can integrate heterogeneous data resources of virtual organizations (VOs). The SRB stores the access control information of individual users in the Metadata Catalog (MCAT) database. However, because of the specific MCAT schema structure, this information can only be used by the SRB applications. If VOs also have many non-SRB applications, each with its own storage format for user access control information, it creates a scalability problem with regard to administration. To solve this problem, we developed a RBAC system with Shibboleth, which is an attribute authorization service currently being used in many Grid environments. Thus, the administration overhead is reduced because the role privileges of individual users are now managed by Shibboleth, not by MCAT or applications. In addition, access control policies need to be specified and managed across multiple VOs. For the specification of access control policies, we used the Core and Hierarchical RBAC profile of the eXtensible Access Control Markup Language (XACML); and for distributed administration of those policies, we used the Object, Metadata and Artifacts Registry (OMAR). OMAR is based on the e-business eXtensible Markup Language (ebXML) registry specifications developed to achieve interoperable registries and repositories. Our RBAC system provides scalable and fine-grain access control and allows privacy protection. Performance analysis shows that our system adds only a small overhead to the existing security infrastructure of the SRB.

Virtual organisations in computer grids and identity management

Information security and access control is an important part of CSCD applying. RBAC (role based access control) as an access control technology using for distributed system has been widely researched these years. Role hierarchies is one component of RBAC model, it can reduce the workload of permission assignment. Nowadays most research of RBAC has no relation with timing constraint. The main purpose of this article is to study the effect of temporal constraint acting on role hierarchy. The basis of the study is RBAC96 model, first we analyse the change of role state, propose 3 forms of temporal constraint and give the expression of temporal constraint. Then we present an analysis of the effects of temporal constraint on role enabling and role activation which has various implication on a role hierarchy, and at last we formally describe a timing restricted role hierarchies model

The increased complexity of modern access control (AC) systems stems partly from the need to support diverse and multiple administrative domains. Systems engineering is a key technology to manage this complexity since it is capable of assuring that an operational system will adhere to the initial conceptual design and defined requirements. Specifically, the verification stage of an AC system should be based on techniques that have a sound and mathematical underpinning. Working on this assumption, model checking techniques are applied for the verification of predefined system properties, and thus, conducting a security analysis of a system. In this paper, we propose the utilization of automated and error-free model checking techniques for the verification of security properties in multi-domain AC systems. Therefore, we propose a formal definition in temporal logic of four AC system properties regarding secure inter-operation with Role-Based Access Control (RBAC) policies in order to be verified by using model checking. For this purpose, we demonstrate the implementation of a tool chain for expressing RBAC security policies, reasoning on role hierarchies and properly feeding the model checking process. The proposed approach can be applied in any RBAC model to efficiently detect non-conformance between an AC system and its security specifications. As a proof of concept, we provide examples illustrating the verification of the defined secure inter-operation properties in multi-domain RBAC policies.

Role-based access control (RBAC) is a promising alternative to traditional discretionary access control (DAC) and mandatory access control (MAC). The central idea of RBAC is that permissions are associated with roles, and users are made members of appropriate roles thereby acquiring the roles’ permissions. RBAC is policy neutral in that the precise policy being enforced is a consequence of how various components of RBACsuch as role hierarchies, constraints and administration of user-role and role-permission assignment-are configured. This raises the important question as to whether RBAC is sufficiently powerful to simulate DAC and MAC. Simulation of MAC in RBAC has been demonstrated earlier by Nyanchama and Osborn and by Sandhu. In this paper we demonstrate how to simulate several variations of DAC in RBAC, using the wellknown RBAC96 model of Sandhu et al. In combination with earlier work we conclude that RBAC encompasses both MAC and DAC.

Access control is generally a rule or procedure that allows, denies, restricts or limit access to system's resources. It may, as well, monitor and record all attempts made to access a system. Access Control may also identify users attempting to access unauthorized resources. It is a mechanism which is very much important for protection in computer security. Various access control models are in use, including the most common Mandatory Access Control (MAC), Discretionary Access Control (DAC) and Role Based Access Control (RBAC). All these models are known as identity based access control models. In all these access control models, user (subjects) and resources (objects) are identified by unique names. Identification may be done directly or through roles assigned to the subjects. These access control methods are effective in unchangeable distributed system, where there are only a set of Users with a known set of services. For this reason, we propose a framework which is well suited to many situations in cloud computing where users or applications can be clearly separated according to their job functions. In this chapter, we proposes a role based access control framework with various features including security of sensitive data, authorization policy and secure data from hackers. Our proposed role based access control algorithm provides tailored and fine level of user access control services without adding complexity, and supports access privileges updates dynamically when a user's role is added or updated.

Role-based access control (RBAC) is a promising alternative to traditional discretionary and mandatory access controls. In RBAC permissions are associated with roles, and users are made members of appropriate roles thereby acquiring the roles' permissions. In this paper we formally show that lattice-based mandatory access controls can be enforced by appropriate configuration of RBAC components. Our constructions demonstrate that role hierarchies and constraints are required to effectively achieve this result. We show that variations of the lattice-based *-property, such as write-up (liberal *-property) and no-write-up (strict *-property), can be easily accommodated in RBAC. Our results attest to the flexibility of RBAC and its ability to accommodate different policies by suitable configuration of role hierarchies and constraints.

In the same way that the Web has evolved from being a technology designed to aid scientific collaboration to one which is employed extensively in e-business and increasingly in e-learning, the Grid is also evolving from its original concept as a highly distributed dynamic source of computing resources “on tap”, like the power grid, for e-science, to a means of supporting enterprise computing across heterogeneous, distributed, virtual organisations. However, even the most recent ideas associated with the Grid, as represented by the Open Grid Services Architecture (OGSA) have not yet explicitly addressed e-learning. Considerable experience has been gained over recent years through the development, deployment and management of Distributed Learning Environments (DLEs). This paper draws upon that experience to summarise Quality of Service (QoS) for elearning, and discusses how these can be supported by the OGSA.

Role based access control (RBAC) used in system software like operating system and database system usually. Using in application system software like digital campus system is difficult, because data access permissions control in application system is very complex. Data access permissions control design and implementation was given in the major application system , through the role based access control (RBAC), rules granted to roles, roles granted to users, setting up rules library for data access control. Permissions rules are described by XML, including three kinds of rules such as: time control, row sets control, column sets control.

The recent trend of access control on the Web-related resource is that the service provider differentiates services according to the user’s attributes such as membership class or job position. For proper and simple representation of the relationships between user’s attributes and permission, role-base access control is used on the Web. As the size of the organization increases, does the number of membership classes or job positions. Naturally, the role hierarchy becomes too complicated to administrate properly. The lack of proper role administration makes the system vulnerable in access control. Moreover, the web services are distributed and categorized by the type of service. It is difficult that a centralized server controls the distribute environment properly. In this paper, we propose a distributed role hierarchy module that can manage the role hierarchy effectively and practically. The proposed system employs the distributed local role hierarchy, and the combination of them represents a logical global role structure. Distributed role hierarchy modules manage local role hierarchy that is related to each of them.

Role based Access Control (RBAC) is known as an evolution in the field of access control. The strength of RBAC is considered due to the incorporation of concept of roles. Separation of Duty (SOD) is a constraint that implements least privilege principle in RBAC. Dynamic Separation of Duty (DSD) is a powerful constraint to control internal security threats. Current RBAC standard implements DSD on the level of roles. This creates various problems. In this paper, various problems in case of implementing DSD on the level of roles are identified. We show and prove that RBAC's strength is the incorporation of concept of roles but this is not for better security in terms of authorization. Instead this helps in better administration or usability for users. The RBAC usability can be improved if RBAC administration is being implemented on the basis of roles and access control can be more secure if DSD is being implemented on the basis of conflicting permissions. The concept of normalized roles is also introduced. The proposed model implements access control on the basis of normalized role. DSD is being implemented on the basis of conflicting permissions and non-conflicting permissions are exercised under the umbrella of role. This becomes a hybrid approach for access control. The administrators are given freedom in implementing DSD in various modes according to the organizational requirements from lenient to strict implementation. The proposed model is also formally specified and the benefits as a result of implementing the proposed model are discussed.

Access control is an important security parameter in industrial networks; a mismanaged access control system leads to security breaches. The existing security solutions significantly consider the access control methods in the Industrial Internet of Things (IIoT); however, falsified identity can bypass the secure access control system. Thus, a centralized access control method leads to risks for data security. We are the first to address the risk factors of granted access in an industrial environment and present a risk-adaptive access control framework for IIoTs. Our proposed solution framework uses blockchain to provide secure decentralized access control in the industrial environment with privacy-preserved multi-party data sharing. We name our framework “Adaptive Access controL for Multi-party data cOmputation in iNdustrial Decentralization (AALMOND)”. AALMOND uses lightweight cryptographic operations to reduce the complexity of the execution and loosen up the tight bounds on resource-constrained industrial devices. Further, the risk-adaptive access control in AALMOND provides a better security analysis of the multi-party sharing data. Our framework uses role-based, attribute-based, and organization-based access controls to map the assets for risk calculation. We put all the required policies in a smart contract for the ease of multi-party data sharing to obtain a transparent access control execution more suitably. We also pioneer in the calculation of the risk adaptivity of AALMOND considering the NIST recommendations of operation risk, security risk, and heuristic risk. We measure the performance of AALMOND with state-of-the-art frameworks based on throughput, latency, complexity analysis, and risk adaptivity factors. We find that AALMOND is efficient for IIoTs as it shows 24% reduced latency and 20% better throughput as compared to the other existing models.

In Grid environments, virtual organizations (VOs) often need to define access control policies to govern who can use which resources for which purpose over multiple policy domains. This is challenging, not only because the entities in VOs must collaborate with each other to share resources across administrative domains, but also because there usually exist a large amount of underlying sites (resource providers) and users in VOs. In this paper, we introduce to use trust management approach to address these problems in Grid environments. We propose a rule-based policy language (RPL) framework to describe the authorization and delegation policies related to VOs, sites and users. This paper also introduces the design of an enhanced community authorization service (ECAS) based on RPL framework, which can be seamlessly integrated with local authorization mechanisms. ECAS uses different kinds of delegation policies for flexible collaboration on authorization between entities in VOs. Compared with similar research works, ECAS enhances the flexibility and scalability of decentralized authorization in Grid environments.KeywordsGridVOAccess ControlTrust Management

In many domains, organizations must model personnel and corresponding data access privileges as fine-grained hierarchical access control models. One class of such models, Role-based Access Control (RBAC) models, has been widely accepted and deployed. However, RBAC models are often used without involving cryptographic keys nor considering confidentiality/privacy at the data level. How to design, implement and dynamically modify such a hierarchy, ensure user and data privacy and distribute and manage necessary cryptographic keys are issues of the utmost importance. One elegant solution for cryptography-based hierarchical access control combines the collusion-resistant and privacy-preserving Access Control Polynomial (ACP) and Atallah's Dynamic and Efficient Extended Key Management scheme. Such a model involves cryptographic keys used to encrypt data, can address confidentiality/privacy at the data level and can efficiently support dynamic changes to the RBAC access hierarchy. In this paper, we discuss several implementation challenges and propose solutions when deploying such a system including: data encryption and decryption, key storage and key distribution. Furthermore, we provide analysis of the efficiency and scalability of the resulting system.

Mobile agent systems provide new perspectives for distributed e-commerce applications. These applications may present specific restrictions, making mobile agent systems a feasible solution. Even so, mobile agents present some security related problems. An important one is resource access control. The ability for mobile agents to provide a simple, scalable, flexible, and secure access control system is a key point for the widespread adoption of mobile agents. In this paper we propose a mechanism to safely assign roles to mobile agents and an access control method based on Role-based Access Control (RBAC). The access control method provides a simple, lightweight and distributed model for mobile agent applications. It is proposed as an extension of the MARISM-A (An Architecture for Mobile Agents with Recursive Itineraries and Secure Migration) project, a secure mobile agent platform.