How to Securely Break into RBAC: The BTG-RBAC Model

Abstract

Access control models describe frameworks that dictate how subjects (e.g. users) access resources. In the Role-Based Access Control (RBAC) model access to resources is based on the role the user holds within the organization. RBAC is a rigid model where access control decisions have only two output options: Grant or Deny. Break The Glass (BTG) policies on the other hand are flexible and allow users to break or override the access controls in a controlled and justifiable manner. The main objective of this paper is to integrate BTG within the NIST/ANSI RBAC model in a transparent and secure way so that it can be adopted generically in any domain where unanticipated or emergency situations may occur. The new proposed model, called BTG-RBAC, provides a third decision option BTG, which grants authorized users permission to break the glass rather than be denied access. This can easily be implemented in any application without major changes to either the application code or the RBAC authorization infrastructure, apart from the decision engine. Finally, in order to validate the model, we discuss how the BTG-RBAC model is being introduced within a Portuguese healthcare institution where the legislation requires that genetic information must be accessed by a restricted group of healthcare professionals. These professionals, advised by the ethical committee, have required and asked for the implementation of the BTG concept in order to comply with the said legislation.

Embedding ‘Break the Glass’ into Business Process Models

“…The designer specifies in advance who, in exceptional cases, will have access rights he normally does not have. In line with [6], the prerequisites to "break the glass" from the application perspective are: (1) regular access is denied, (2) BTG access is foreseen for the exceptional case, (3) a user explicitly asks for access, (4) optionally, another user has to agree to this access. We call the sequence of steps when users ask for exceptional access BTG steps in the following.…”

“…From the perspective of the components enforcing authorizations for data access, the application has to perform several tasks for a BTG option and the compensating obligations [6]: First, the authorization system must deny a regular request, but offer the possibility for a BTG access to the application. In the next step, the holder of BTG Access Role must explicitly ask for access under BTG conditions.…”

“…This is new and challenging, because existing approaches providing authorization infrastructures for BTG (e.g., [1], [6], [11] and [7]), do not cover the following aspects: (1) Modelling BTG steps and obligations as part of the BP and executing them. (2) Considering BP-specific features, BP context in particular.…”

Can Transparency Enhancing Tools Support Patient’s Accessing Electronic Health Records?

“…BTG: Break-the-glass has been proposed as part of access control in healthcare and gives the possibility to override (temporarily or as specified) the access control policy in a controlled manner, for instance, in emergency or unanticipated situations [26]; PURUSE: Purpose of use has been suggested by the HL7 Security Technical…”

“…These constraints are also necessary in order to create temporary roles, which are defined for a specific limited time (e.g., delegation or BTG); DELEG: Delegation is also part of the model proposed in [22] and it allows granting temporary access permissions to healthcare professionals who normally do not treat the patient (i.e., asking for a second opinion). OBLS: Obligations in healthcare were proposed in [26]. These are secondary actions triggered by primary actions.…”