A rule-based framework for role-based delegation and revocation

ABSTRACT

Delegation is the process whereby an active entity in a distributed environment authorizes another entity to access resources. In today's distributed systems, a user often needs to act on another user's behalf with some subset of his/her rights. Most systems have attempted to resolve such delegation requirements with ad-hoc mechanisms by compromising existing disorganized policies or simply attaching additional components to their applications. Still, there is a strong need in the large, distributed systems for a mechanism that provides effective privilege delegation and revocation management. This paper describes a rule-based framework for role-based delegation and revocation. The basic idea behind a role-based delegation is that users themselves may delegate role authorities to others to carry out some functions authorized to the former. We present a role-based delegation model called RDM2000 (role-based delegation model 2000) supporting hierarchical roles and multistep delegation. Different approaches for delegation and revocation are explored. A rule-based language for specifying and enforcing policies on RDM2000 is proposed. We describe a proof-of-concept prototype implementation of RDM2000 to demonstrate the feasibility of the proposed framework and provide secure protocols for managing delegations. The prototype is a web-based application for law enforcement agencies allowing reliable delegation and revocation. The future directions are also discussed.

REFERENCES

• 1: Martín Abadi , Michael Burrows , Butler Lampson , Gordon Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems (TOPLAS), v.15 n.4, p.706-734, Sept. 1993 [doi>10.1145/155183.155225]
• 2: Serge Abiteboul , Stéphane Grumbach, A rule-based language with functions and sets, ACM Transactions on Database Systems (TODS), v.16 n.1, p.1-30, March 1991 [doi>10.1145/103140.103141]
• 3: Gail-Joon Ahn , Ravi Sandhu, Role-based authorization constraints specification, ACM Transactions on Information and System Security (TISSEC), v.3 n.4, p.207-226, Nov. 2000 [doi>10.1145/382912.382913]
• 4: Tuomas Aura, Distributed access-rights management with delegation certificates, Secure Internet programming: security issues for mobile and distributed objects, Springer-Verlag, London, 2001
• 5: E. Barka , R. Sandhu, Framework for role-based delegation models, Proceedings of the 16th Annual Computer Security Applications Conference, p.168, December 11-15, 2000
• 6: Barka, E. and Sandhu, R. 2000. Framework for role-based delegation model. In Proceedings of 23rd National Information Systems Security Conference, Baltimore, October 16--19, 2000b, 101--114.
• 7: Bhamidipati, V. and Sandhu, R. 2000. Push Architectures for USER ROLE assignment. In Proceedings of 23rd National Information Systems Security Conference, Baltimore, October 16--19, 2000, 89--100.
• 8: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 9: Matt Blaze , Joan Feigenbaum , John Ioannidis , Angelos D. Keromytis, The role of trust management in distributed systems security, Secure Internet programming: security issues for mobile and distributed objects, Springer-Verlag, London, 2001
• 10: Ellison, C., Frantz, B., Lampson, B., Rivest, R., Thomas, B., and Ylonen, T. 1999. SPKI Certificate Theory, RFC2693, http://www.ietf.org/rfc/rfc2693.txt, 1999.
• 11: David F. Ferraiolo , John F. Barkley , D. Richard Kuhn, A role-based access control model and reference implementation within a corporate intranet, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.34-64, Feb. 1999 [doi>10.1145/300830.300834]
• 12: Ferraiolo, D., Cugini, J., and Kuhn, D. R. 1995. Role-based access control (RBAC): features and Motivations. In Proceedings of 11th Annual Computer Security Application Conference. New Orleans, LA, December 11--15 1995, 241--241.
• 13: Ben Forta , Nate Weiss , Gerry Libertelli, Advanced ColdFusion 4 Application Development with CDROM, Que Corp., Indianapolis, IN, 1999
• 14: Ben Forta , Matt Reider , Matt Boles, Certified ColdFusion Developer Study Guide, Macromedia Press, 2001
• 15: Gasser, M. and McDermott, E. 1990. An architecture for practical delegation a distributed system. IEEE Computer Society Symposium on Research in Security and Privacy. Oakland, CA, May 7--9, 1990.
• 16: H. M. Gladney, Access control for large collections, ACM Transactions on Information Systems (TOIS), v.15 n.2, p.154-194, April 1997 [doi>10.1145/248625.248652]
• 17: Åsa Hagström , Sushil Jajodia , Francesco Parisi-Presicce , Duminda Wijesekera, Revocations-A Classification, Proceedings of the 14th IEEE Workshop on Computer Security Foundations, p.44, June 11-13, 2001
• 18: Hayton, R., Bacon, J., and Moody, K. 1998. OASIS: access control in an open, distributed environment. In Proceedings of 1998 IEEE Symposium on Security and Privacy. Oakland, CA, May 3--6. IEEE Computer Society Press, Los Alamitos, CA, 3--14.
• 19: Sushil Jajodia , Pierangela Samarati , V. S. Subrahmanian, A Logical Language for Expressing Authorizations, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.31, May 04-07, 1997
• 20: Butler Lampson , Martín Abadi , Michael Burrows , Edward Wobber, Authentication in distributed systems: theory and practice, ACM Transactions on Computer Systems (TOCS), v.10 n.4, p.265-310, Nov. 1992 [doi>10.1145/138873.138874]
• 21: Ninghui Li , Joan Feigenbaum , Benjamin N. Grosof, A Logic-based Knowledge Representation for Authorization with Delegation, Proceedings of the 1999 IEEE Computer Security Foundations Workshop, p.162, June 28-30, 1999
• 22: Ninghui Li , Benjamin Grosof , Joan Feigenbaum, A Practically Implementable and Tractable Delegation Logic, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.27, May 14-17, 2000
• 23: Liebrand, M., Ellis, H. J., Phillips, C., and Ting, T. C. 2002. Role delegation for a distributed, unified RBAC/MAC. In Proceedings of Sixteenth Annual IFIP WG 11.3 Working Conference on Data and Application Security King's College, University of Cambridge, UK July 29--31, 2002.
• 24: John Linn , Magnus Nyström, Attribute certification: an enabling technology for delegation and role-based controls in distributed environments, Proceedings of the fourth ACM workshop on Role-based access control, p.121-130, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319183]
• 25: McNamara, C. 1997. Basics of delegating. http://www.mapnp.org/library/guiding/delegate/basics.htm.
• 26: Ravi Sandhu, Rationale for the RBAC96 family of access control models, Proceedings of the first ACM Workshop on Role-based access control, p.9-es, November 30-December 02, 1995, Gaithersburg, Maryland, United States [doi>10.1145/270152.270167]
• 27: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• 28: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 29: Wielemaker, J. SWI-Prolog. http://www.swi.psy.uva.nl/projects/SWI-Prolog/
• 30: Walt Yao , Ken Moody , Jean Bacon, A model of OASIS role-based access control and its support for active security, Proceedings of the sixth ACM symposium on Access control models and technologies, p.171-181, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373294]
• 31: Longhua Zhang , Gail-Joon Ahn , Bei-Tseng Chu, A rule-based framework for role based delegation, Proceedings of the sixth ACM symposium on Access control models and technologies, p.153-162, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373289]
• 32: Longhua Zhang , Gail-Joon Ahn , Bei-Tseng Chu, A role-based delegation framework for healthcare information systems, Proceedings of the seventh ACM symposium on Access control models and technologies, June 03-04, 2002, Monterey, California, USA [doi>10.1145/507711.507731]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Management, Security

Keywords:
Role, access control, delegation, revocation, rule-based