No abstract

The aim of this work is to give a formal foundation to the notion of role-based access control through the introduction of a new model and the formal specification of its semantics.The proposed model takes into account all the main topics currently under discussion in this area, including constraints and separation of duties. Moreover, it is suitable both for conceptual design purpose and direct implementation within real systems.

No abstract

This paper describes a new extension of the security features provided by the Java platform. This extension provides complex role-based access control mechanisms that take advantage of a new Java security service designed to enforce access controls based on who runs the code. This extension will be utilized to define a new architecture that allows the design and implementation of role-based security policies for Web applications. using server-side Java technologies.

As the Java platform is becoming attractive and convenient for the construction of cross-platform clientserver applications, the problem of developing and managing effective security policies in that environment becomes critical.This paper analyzes the security features provided by the new Java platform in order to identify how it is possible to improve them by providing state-of-the-art role-based access control mechanisms.