Process-oriented approach for role-finding to implement role-based security administration in a large industrial organization

ABSTRACT

In this paper we describe the work in progress with a process-oriented approach for role-finding to implement Role-Based Security Administration. Our results stem from using a recently proposed role model and procedural model at Siemens AG ICN, a large industrial organization. The core of this paper presents the data model, which integrates business processes, role based security administration and access control. Moreover, a structured top-down approach is outlined which is the basis for derivation of suitable business roles from enterprise process models. A brief description is given on how these results may be used to first build the Role Catalog and then support the implementation of RBAC and a single point of administration and control, using a cross-platform administration tool.

REFERENCES

• Awi: Roland Awischus, Role based access control with the security administration manager (SAM), Proceedings of the second ACM workshop on Role-based access control, p.61-68, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266758]
• Bar: John Barkley, Implementing role-based access control using object technology, Proceedings of the first ACM Workshop on Role-based access control, p.20-es, November 30-December 02, 1995, Gaithersburg, Maryland, United States [doi>10.1145/270152.270192]
• Bez: Konstantin Beznosov, Requirements for access control: US Healthcare domain, Proceedings of the third ACM workshop on Role-based access control, p.43, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286892]
• ES: Pete Epstein , Ravi Sandhu, Towards a UML based approach to role engineering, Proceedings of the fourth ACM workshop on Role-based access control, p.135-143, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319184]
• FBK: David F. Ferraiolo , John F. Barkley , D. Richard Kuhn, A role-based access control model and reference implementation within a corporate intranet, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.34-64, Feb. 1999 [doi>10.1145/300830.300834]
• FCK: Ferraiolo, D.F., Cugini, J.A., Kuhn, R.D.; Role-Based Access Control (RBAC): Features and Motivations; Proc. 11 th Annual Computer Security Applications, New Orleans, Louisiana (1995)
• FH: E. B. Fernandez , J. C. Hawkins, Determining role rights from use cases, Proceedings of the second ACM workshop on Role-based access control, p.121-125, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266767]
• Fly: Flynn, H.; ~Real-Life" Use of Roles for Access Control; Gartner Advisory, Monthly Research Review August 1998 (1998)
• HDLG: Hummel, A.A., Deinhart, K., Lorenz, S., Gligor, V.D.; Role-Based Security Administration; Proc. Sicherheit in Informationssystemen (SIS '96), Vienna, Editors: K. Bauknecht, D. Karagiannis, S. Teufel (1996)
• JGIL: Trent Jaeger , Frederique Giraud , Nayeem Islam , Jochen Liedtke, A role-based access control model for protection domain derivation and management, Proceedings of the second ACM workshop on Role-based access control, p.95-106, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266764]
• Mah: Maher, A.; A Universe of One~; Siemens AG Information and Communication Networks, press conference February 7 th , 2000 (2000)
• PS: Parker, T., Sundt, C.; Role-Based Access Control in Real Systems; Information Systems Security, Spring (1996)
• Roe: Roeckle, H.; Rollenbasierter Zugriffsschutz, Automatisierte Bildung der Rollen im Unternehmen auf der Basis eines prozessorientierten Vorgehensmodells; IT-Sicherheit 2/99, datacontext fachverlag, Frechen (1999)
• RoFi: Roeckle IT-Sicherheit GmbH; RollenFinder Benutzer Dokumentation; RoFi-Handb~cher, Rel. 1.0, Bochum (2000)
• SAM: Schumann Unternehmensberatung AG; Security Administration Manager (SAM), Concepts and Facilities; SAM-Manuals, Rel. 2.4, Koeln (1999)
• San: Ravi Sandhu, Role activation hierarchies, Proceedings of the third ACM workshop on Role-based access control, p.33-40, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286891]
• SBM: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• SCFY: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• SMF: Gerhard Schimpf, Security management for administration and control of corporate-wide, diverse systems, ACM SIGSAC Review, v.15 n.1, p.4-10, Jan. 1997 [doi>10.1145/250021.250022]
• SRM: Schumann Unternehmensberatung AG; SAM Request Manager (SAM/RM), User Manual; SAM/RM-Manuals, Rel. 2.1, Koeln (1999)
• TBB: D. Thomsen , R. O'Brien , C. Payne, Napoleon: network application policy environment, Proceedings of the fourth ACM workshop on Role-based access control, p.145-152, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319185]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.1 Logical Design
          Subjects: Data models
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.8 Problem Solving, Control Methods, and Search
          Subjects: Control theory
  I.6 SIMULATION AND MODELING

General Terms:
Design, Management, Performance, Security, Theory

Keywords:
access control, authorizations, business processes, enterprise process modeling, heterogeneous systems, role based access control, security administration, security data models, security management, security models, single point of administration and control