Context sensitivity in role-based access control

Abstract

This paper describes an extended role-based access control (RBAC) model, which makes RBAC sensitive to the context of an attempted operation. Traditional RBAC does not specify whether the permissions associated with a role enable access to a particular object, or to some subset of objects belonging to a class. We extend the model by introducing the notions of role context and context filters. Context filters are Boolean expressions based on the context of the user attempting the operation, as well as the context of the object upon which the operation is attempted. By supplying context filters during the definition of a role, a security administrator can easily limit the applicability of users' role memberships to particular subsets of the target objects. We also describe our implementation of the model in a web-services platform, to illustrate how this technique is particularly valuable when the data is hierarchically structured.

Privacy in Georeferenced Context-Aware Services: A Survey

“…Context-aware access control strategies fall in two main categories. The first category is the one of techniques aimed at granting or denying access to resources considering the context of the requesting user and of the resource (see, e.g., [19][20][21]). The second category is the one of techniques aimed at controlling the release of user's context data on the basis of the context of the requesting entity and of the user herself.…”

“…However, the baseline RBAC model is not adequate to pervasive and mobile computing domains, which are characterized by the dynamics of situations that may determine the role played by a given entity in a given context. For this reason, various proposals have been made to extend RBAC policies with contextual conditions (see, e.g., [19]), and in particular with spatio-temporal constraints (e.g., [30]). More recently, this approach has been applied to the privacy protection of personal context data.…”

Conformance Checking of Dynamic Access Control Policies

“…Our concern in this paper is the construction of access control policies that rely on context to inform decisions. (Arguments as to the potential benefits of context-sensitive access control have been made by, for example, [1], [2], and [3].) Specifically, our concern is what might be termed evolving access controlwhereby access control decisions are made on the basis of state.…”

“…1 Of course, the use of access control policies can bring many benefits when managing complex systems: by centralising all authorisation decisions, consistency of access can be maintained, and updating a single access control policy is much simpler than modifying multiple components. Nevertheless, creating and updating access control policies is still a potentially time-consuming task.…”

“…It should be noted that the modelling and analysis of RBAC constraints has a rich history, with the work of [20] and [21] being of particular note. 1 See http://www.oasis-open.org/committees/xacml/. 2 Other work that has built policy analysis tools on Alloy include the contributions of [11], [12] and [13].…”