Temporal Role Hierarchies

The increased complexity of modern access control (AC) systems stems partly from the need to support diverse and multiple administrative domains. Systems engineering is a key technology to manage this complexity since it is capable of assuring that an operational system will adhere to the initial conceptual design and defined requirements. Specifically, the verification stage of an AC system should be based on techniques that have a sound and mathematical underpinning. Working on this assumption, model checking techniques are applied for the verification of predefined system properties, and thus, conducting a security analysis of a system. In this paper, we propose the utilization of automated and error-free model checking techniques for the verification of security properties in multi-domain AC systems. Therefore, we propose a formal definition in temporal logic of four AC system properties regarding secure inter-operation with Role-Based Access Control (RBAC) policies in order to be verified by using model checking. For this purpose, we demonstrate the implementation of a tool chain for expressing RBAC security policies, reasoning on role hierarchies and properly feeding the model checking process. The proposed approach can be applied in any RBAC model to efficiently detect non-conformance between an AC system and its security specifications. As a proof of concept, we provide examples illustrating the verification of the defined secure inter-operation properties in multi-domain RBAC policies.

Role-based access control (RBAC) is a promising alternative to traditional discretionary access control (DAC) and mandatory access control (MAC). The central idea of RBAC is that permissions are associated with roles, and users are made members of appropriate roles thereby acquiring the roles’ permissions. RBAC is policy neutral in that the precise policy being enforced is a consequence of how various components of RBACsuch as role hierarchies, constraints and administration of user-role and role-permission assignment-are configured. This raises the important question as to whether RBAC is sufficiently powerful to simulate DAC and MAC. Simulation of MAC in RBAC has been demonstrated earlier by Nyanchama and Osborn and by Sandhu. In this paper we demonstrate how to simulate several variations of DAC in RBAC, using the wellknown RBAC96 model of Sandhu et al. In combination with earlier work we conclude that RBAC encompasses both MAC and DAC.

Role-based access control (RBAC) is a promising alternative to traditional discretionary and mandatory access controls. In RBAC permissions are associated with roles, and users are made members of appropriate roles thereby acquiring the roles' permissions. In this paper we formally show that lattice-based mandatory access controls can be enforced by appropriate configuration of RBAC components. Our constructions demonstrate that role hierarchies and constraints are required to effectively achieve this result. We show that variations of the lattice-based *-property, such as write-up (liberal *-property) and no-write-up (strict *-property), can be easily accommodated in RBAC. Our results attest to the flexibility of RBAC and its ability to accommodate different policies by suitable configuration of role hierarchies and constraints.

This paper proposes an extension of the conventional role-based access control (RBAC model) called enhanced role-based access control or ERBAC03 model. The model is developed for the role-based access control of information system resources in large organizations that have many branches. Each branch consists of many users with different roles. It is related to a specified static separation of duty constraint in order to prevent fraud of users. We analyze the result of RBAC and ERBAC03 models by a number of experiments based on users' locations. The result proves that the proposed ERBAC03 model eliminates the inaccuracy of access control administration that has incurred in the conventional RBAC model. Any conflicting role is not allowed to be added to the associated database tables.

In many domains, organizations must model personnel and corresponding data access privileges as fine-grained hierarchical access control models. One class of such models, Role-based Access Control (RBAC) models, has been widely accepted and deployed. However, RBAC models are often used without involving cryptographic keys nor considering confidentiality/privacy at the data level. How to design, implement and dynamically modify such a hierarchy, ensure user and data privacy and distribute and manage necessary cryptographic keys are issues of the utmost importance. One elegant solution for cryptography-based hierarchical access control combines the collusion-resistant and privacy-preserving Access Control Polynomial (ACP) and Atallah's Dynamic and Efficient Extended Key Management scheme. Such a model involves cryptographic keys used to encrypt data, can address confidentiality/privacy at the data level and can efficiently support dynamic changes to the RBAC access hierarchy. In this paper, we discuss several implementation challenges and propose solutions when deploying such a system including: data encryption and decryption, key storage and key distribution. Furthermore, we provide analysis of the efficiency and scalability of the resulting system.

The recent trend of access control on the Web-related resource is that the service provider differentiates services according to the user’s attributes such as membership class or job position. For proper and simple representation of the relationships between user’s attributes and permission, role-base access control is used on the Web. As the size of the organization increases, does the number of membership classes or job positions. Naturally, the role hierarchy becomes too complicated to administrate properly. The lack of proper role administration makes the system vulnerable in access control. Moreover, the web services are distributed and categorized by the type of service. It is difficult that a centralized server controls the distribute environment properly. In this paper, we propose a distributed role hierarchy module that can manage the role hierarchy effectively and practically. The proposed system employs the distributed local role hierarchy, and the combination of them represents a logical global role structure. Distributed role hierarchy modules manage local role hierarchy that is related to each of them.

In this paper, we propose a role-based access control (RBAC) system for data resources in the Storage Resource Broker (SRB). The SRB is a Data Grid management system, which can integrate heterogeneous data resources of virtual organizations (VOs). The SRB stores the access control information of individual users in the Metadata Catalog (MCAT) database. However, because of the specific MCAT schema structure, this information can only be used by the SRB applications. If VOs also have many non-SRB applications, each with its own storage format for user access control information, it creates a scalability problem with regard to administration. To solve this problem, we developed a RBAC system with Shibboleth, which is an attribute authorization service currently being used in many Grid environments. Thus, the administration overhead is reduced because the role privileges of individual users are now managed by Shibboleth, not by MCAT or applications. In addition, access control policies need to be specified and managed across multiple VOs. For the specification of access control policies, we used the Core and Hierarchical RBAC profile of the eXtensible Access Control Markup Language (XACML); and for distributed administration of those policies, we used the Object, Metadata and Artifacts Registry (OMAR). OMAR is based on the e-business eXtensible Markup Language (ebXML) registry specifications developed to achieve interoperable registries and repositories. Our RBAC system provides scalable and fine-grain access control and allows privacy protection. Performance analysis shows that our system adds only a small overhead to the existing security infrastructure of the SRB.

Role -based access control (RBAC) has been introduced in the last few years, and offers a powerful means of specifying access control decisions. The model of RBAC usually assumes that, if there is a role hierarchy, then access rights are inherited upwards through the hierarchy. This paper examines the relationship between the inheritance properties of role hierarchies and control principles which are used in many large organisations: separation of duties; delegation; and supervision and review. It discusses possible relationships between roles and identifies three different kinds of role hierarchy. The control principles and role hierarchies are illustrated in a realistic application, and their interactions are discussed. It emerges that there may be conflict between control principles and the inheritance of access rights through a role hierarchy. Some ways in which role hierarchies can be used for safe inheritance of access rights are discussed.

Role based Access Control (RBAC) is known as an evolution in the field of access control. The strength of RBAC is considered due to the incorporation of concept of roles. Separation of Duty (SOD) is a constraint that implements least privilege principle in RBAC. Dynamic Separation of Duty (DSD) is a powerful constraint to control internal security threats. Current RBAC standard implements DSD on the level of roles. This creates various problems. In this paper, various problems in case of implementing DSD on the level of roles are identified. We show and prove that RBAC's strength is the incorporation of concept of roles but this is not for better security in terms of authorization. Instead this helps in better administration or usability for users. The RBAC usability can be improved if RBAC administration is being implemented on the basis of roles and access control can be more secure if DSD is being implemented on the basis of conflicting permissions. The concept of normalized roles is also introduced. The proposed model implements access control on the basis of normalized role. DSD is being implemented on the basis of conflicting permissions and non-conflicting permissions are exercised under the umbrella of role. This becomes a hybrid approach for access control. The administrators are given freedom in implementing DSD in various modes according to the organizational requirements from lenient to strict implementation. The proposed model is also formally specified and the benefits as a result of implementing the proposed model are discussed.

Access control is an important protection mechanism for information system. Access control enforces subjects access restrictions to objects. Legitimate users should be allowed to access objects and illegitimate users should be detained from accessing objects. Access control between multi-user and multi-object is the key technique in security management of workflow management systems (WfMS), and the mechanism of the role-based authorization and access control is an effective way to solve the problem. This paper designs a set of practical constraint mechanism of role-based access control for WfMS. After introducing authorization constraint mechanism, a new model of role-based access control, RBACWF, is proposed. The role assignment algorithm, role-assign(tasknumber, pre_ass) , is also given as a key technique in this model. After this, an application example is given to explain the execution of the algorithm. Finally, a practical WfMS based on above designs is supplied. The practice in the system’s design and execution has proved that the authorization mechanism is flexible, the performance of the access security is improved greatly, and it also simplifies the task complexity of security administrator.

Dynamically monitoring the state changes of an underlying system, detecting and reacting to changes without delay are crucial for the success of any access control enforcement mechanism. With their inherent nature, active (Event- Condition-Action or ECA) rules are prospective candidates to carry out change detection and to provide access control. Current systems or models do not provide a flexible mechanism for enforcing Role-Based Access Control (RBAC) standard and its extensions in a seamless way, and do not adapt to policy or role structure changes in enterprises, which are indispensable to make RBAC usable in diverse domains. In this paper we will show how On-When-Then-Else authorization rules (or enhanced ECA rules) are used for enforcing RBAC standard and its extensions such as generalized temporal RBAC, control flow dependency constraints, privacy-aware RBAC, and so forth in a seamless way. Furthermore, these rules also provide active security. Large enterprises have hundreds of roles, which requires thousands of rules for providing access control, and generating these rules manually is error-prone and a cognitive-burden for non-computer specialists. Thus, in this paper, we will discuss briefly how these authorization rules can be automatically (or semi-automatically) generated from high level specifications of enterprise access control policies. We will also discuss the implementation using Sentinel+, an active object oriented system.

Role hierarchies are fundamental to the role based access control (RBAC) model. The notion of role hierarchy is a well understood concept that allows senior roles to inherit the permissions of the corresponding junior roles. Role hierarchies further ease the burden of security administration, as there is no need to explicitly specify and maintain a large number of permissions. Given a set of roles or user permissions, one may construct a number of alternative hierarchies. However, there does not exist the notion of an optimal role hierarchy. Optimality helps in maximizing the benefit of employing the role hierarchy. In this paper, we propose such a formal metric. Our optimality notion is based on the smallest graph representation of the role hierarchy (minimal in the number of edges) having the same transitive closure as any alternate representation. We show why this makes sense as well as ways to achieve this. The main contributions of this paper are to formalize the notion of optimality for role hierarchy construction, along with proposing heuristic solutions to achieve this objective, thus making role hierarchies feasible and practical.

In the modern computing era, access to resources is often restricted through contextual information and the attributes of users, objects and various other entities. Attribute-Based Access Control (ABAC) can capture those requirements as a policy, but it is not yet adopted like Role Based Access Control (RBAC) due to lack of a comprehensive administrative model. In the last few years, several efforts have been made to combine ABAC with RBAC, but they are limited to specification and enforcement only. Recently, we have presented a unified framework along with a role based administrative model that enables specification, enforcement and maintenance of unified access control policies, such as ABAC, RBAC and Meta-Policy Based Access Control (MPBAC). This paper describes role-based administrative model components and then present a methodology which uses a fixed-point based approach for verifying the security properties (like safety and liveness) of those policies in the presence of the administrative model. We also analyse the impact of ABAC, RBAC, MPBAC and administrative model components on the time taken for security analysis. Experimental results demonstrate that the proposed approach is scalable as well as effective.

Over the years, role based access control (RBAC) has remained a dominant form of access control both in the industry and academia. More recently, the need for risk awareness in access control has received considerable attention in the research community in light of issues such as insider threats. Although RBAC facilitates risk mitigation via features such as constraints (e.g. static and dynamic separation of duty), a quantified approach of risk awareness/mitigation has emerged as a promising research theme due to its inherent flexibility. In this approach, risk/cost metrics are computed for various entities involved in access control such as users and objects and a risk threshold limits the permissions that can be exercised. The quantified approach accommodates dynamism in access decisions based on contexts/situations such as an employee accessing a sensitive file using a work computer versus accessing using her own device. In this paper, we analyze the difference between the traditional constraint-based risk mitigation and the recent quantified risk-aware approaches in RBAC and propose a framework for introducing risk-awareness in RBAC models that incorporates quantified-risk. We also provide a formal specification of an adaptive risk-aware RBAC model by enhancing the NIST core RBAC model.

CRBAC: Imposing multi-grained constraints on the RBAC model in the multi-application environment