TRBAC: a temporal role-based access control model

ABSTRACT

Role-based access control (RBAC) models are receiving increasing attention as a generalized approach to access control. Roles can be active at certain time periods and non active at others; moreover, there can be activation dependencies among roles. To tackle such dynamic aspects, we introduce Temporal-RBAC (TRBAC), an extensions of the RBAC model. TRBAC supports both periodic activations and deactivations of roles, and temporal dependencies among such actions, expressed by means of role triggers, whose actions may be either executed immediately, or be deferred by an explicity specified amount of time. Both triggers and periodic activations/deactivations may have a priority associated with them, in order to resolve conflicting actions. A formal semantics for the specification language is provided, and a polynomial safeness check is introduced to reject ambiguous or inconsistent specifications. Finally, an implementation architecture is outlined.

REFERENCES

• 1: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, An access control model supporting periodicity constraints and temporal reasoning, ACM Transactions on Database Systems (TODS), v.23 n.3, p.231-285, Sept. 1998 [doi>10.1145/293910.293151]
• 2: Thomas T. Cormen , Charles E. Leiserson , Ronald L. Rivest, Introduction to algorithms, MIT Press, Cambridge, MA, 1990
• 3: Trent Jaeger , Atul Prakash , Jochen Liedtke , Nayeem Islam, Flexible control of downloaded executable content, ACM Transactions on Information and System Security (TISSEC), v.2 n.2, p.177-228, May 1999 [doi>10.1145/317087.317091]
• 4: Dirk Jonscher , Jonathan D. Moffett , Klaus R. Dittrich, Complex Subjects, or: The Striving for Complexity is Ruling our World, Proceedings of the IFIP WG11.3 Working Conference on Database Security VII, p.19-37, September 12-15, 1993
• 5: M. Niezette and J. Stevenne. An efficient symbolic representation of periodic time. In Proc. First International Conference on Information and Knowledge Management, 1992.
• 6: Matunda Nyanchama , Sylvia Osborn, Role-based security, object oriented databases and separation of duty, ACM SIGMOD Record, v.22 n.4, p.45-51, Dec. 1993 [doi>10.1145/166635.166652]
• 7: Proc. of the Second ACM Workshop on Role-Based Access Control, Fairfax (VA), 1997.
• 8: Proc. of the Third ACM Workshop on Role-Based Access Control, Fairfax (VA), 1998.
• 9: Proc. of the Fourth ACM Workshop on Role-Based Access Control, Fairfax (VA), 1999.
• 10: R. Sandhu. Separation of Duties in Computerized Information Systems. In Database Security IV: Status and Prospects, pages 179-189. North Holland, 1991.
• 11: Ravi S. Sandhu, Role Hierarchies and Constraints for Lattice-Based Access Controls, Proceedings of the 4th European Symposium on Research in Computer Security: Computer Security, p.65-79, September 25-27, 1996
• 12: R. Sandhu. Role-based Access Control. Advances in Computers, vol. 46, Academic Press, 1998.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

  F. Theory of Computation
  F.3 LOGICS AND MEANINGS OF PROGRAMS

  I. Computing Methodologies
  I.6 SIMULATION AND MODELING

General Terms:
Algorithms, Design, Languages, Performance, Security, Theory