Modeling Mandatory Access Control in Role-Based Security Systems

On the Modeling of Bell-LaPadula Security Policies Using RBAC

“…Nyanchama and Osborn [6] presented a way to model mandatory access control in RBAC systems. Nyanchama and Osborn argued that this could benefit from the flexible permission allocation management provided by RBAC models as well as the powerful modeling capability of RBAC models.…”

Applications of the Oriented Permission Role-Based Access Control Model

“…There have been several attempts to implement BLP models using role-based models [13,14,15,16]. Osborn et al's approach [13,14,15] shows how the role-graph model can be configured to enforce information flow policies.…”

“…Osborn et al's approach [13,14,15] shows how the role-graph model can be configured to enforce information flow policies. In their approach the lattice of security label is defined separately and independently from the role graph.…”

“…Since the introduction of RBAC, several authors have discussed the relationship between RBAC and the Bell-LaPadula model (BLP) [13,14,15,16]. Osborn et al [15] show that information flow policies in a number of different versions of BLP can be implemented in RBAC by the addition of a second role hierarchy and some constraints on the RBAC relations.…”

Modelling access policies using roles in requirements engineering

“…Separation of duties can be achieved by defining mutually exclusive roles, which have to be invoked for a collaborative task, in order to ensure that a sequence of tasks cannot be carried out by a single individual. Furthermore, RBAC can coexist with, or be used to support, mandatory access control policy [13] such as BLP or a discretionary access control policy [16], where users are assigned permissions individually. There is quite a significant variation in the interpretation of RBAC, differing in the level of sophistication that different models support.…”