Induced role hierarchies with attribute-based RBAC

ABSTRACT

The Role-Based Access Control (RBAC) model is traditionally used to manually assign users to appropriate roles. When the service-providing enterprise has a massive customer base, assigning users to roles ought to be automated. RB-RBAC (Rule-Based RBAC) provides the mechanism to dynamically assign users to roles based on a finite set of authorization rules defined by the enterprise's security policy. These rules may have seniority relation among them, which induces a roles hierarchy. The main contribution of this paper is to explore the possible discrepancies between the Induced Roles Hierarchy and any existing roles hierarchy. The functional impact of existing discrepancies and ways of reconciling them are discussed.

REFERENCES

• 1: Mohammad A. Al-Kahtani , Ravi Sandhu, A Model for Attribute-Based User-Role Assignment, Proceedings of the 18th Annual Computer Security Applications Conference, p.353, December 09-13, 2002
• 2: Dynamic Groups for LDAPV3 draft-haripriya-dynamicgroup-00.txt, (October 2001).
• 3: Amir Herzberg , Yosi Mass , Joris Michaeli , Yiftach Ravid , Dalit Naor, Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.2, May 14-17, 2000
• 4: Lightweight Directory Access Protocol (v3), RFC2251, (December 1997).
• 5: Joon S. Park , Ravi Sandhu , Gail-Joon Ahn, Role-based access control on the web, ACM Transactions on Information and System Security (TISSEC), v.4 n.1, p.37-71, Feb. 2001 [doi>10.1145/383775.383777]
• 6: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• 7: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 8: Walt Yao , Ken Moody , Jean Bacon, A model of OASIS role-based access control and its support for active security, Proceedings of the sixth ACM symposium on Access control models and technologies, p.171-181, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373294]
• 9: Zhong, Y., Bhargava, B., and Mahoui, M. Trustworthiness based authorization on WWW. In IEEE workshop on "Security in Distributed Data Warehousing" (New Orleans, October 2001).

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

General Terms:
Security

Keywords:
RBAC, access control, attributes, authorization rules, roles, roles hierarchies