Proposal of a Dynamic Access Control Model Based on Roles and Delegation for Intelligent Systems Using Realm

Bilong, Jeanne Roux Ngo; Seyed, Cheikhane; Mendy, Gervais; Ouya, Samuel; Gaye, Ibrahima

doi:10.1007/978-3-030-11932-4_38

Cited by 1 publication

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Separation of duties prevents users from exceeding the level of authority in relation to their position by implementing constraints that limit a user's permissions. Static separation of duties implements constraints on user-role (Alhaqbani and Fidge, 2007;Bertino and Takahashi, 2011;Bilong et al, 2020;Desai, 2012;Furnell et al, 2008;Igarashi and Watanobe, 2018;Kuhn et al, 2010;Mao et al, 2009;Rasiwasia, 2017;Sifou et al, 2017;Tellabi et al, 2018) ICS 28,3 assignments while dynamic separation of duties implements constraints on user-role activations within a session. While RBAC has advantages over the other access control models, one of its most notable disadvantages is that it does not support the handling of dynamic events (INCITS, 2012b;Kuhn et al, 2010;Sifou et al, 2017;Singh et al, 2019).…”

Section: Authorisationmentioning

confidence: 99%

A Clark-Wilson and ANSI role-based access control model

Tsegaye

Flowerday

2020

ICS

View full text Add to dashboard Cite

Purpose An electronic health record (EHR) enables clinicians to access and share patient information electronically and has the ultimate goal of improving the delivery of healthcare. However, this can create security and privacy risks to patient information. This paper aims to present a model for securing the EHR based on role-based access control (RBAC), attribute-based access control (ABAC) and the Clark-Wilson model. Design/methodology/approach A systematic literature review was conducted which resulted in the collection of secondary data that was used as the content analysis sample. Using the MAXQDA software program, the secondary data was analysed quantitatively using content analysis, resulting in 2,856 tags, which informed the discussion. An expert review was conducted to evaluate the proposed model using an evaluation framework. Findings The study found that a combination of RBAC, ABAC and the Clark-Wilson model may be used to secure the EHR. While RBAC is applicable to healthcare, as roles are linked to an organisation’s structure, its lack of dynamic authorisation is addressed by ABAC. Additionally, key concepts of the Clark-Wilson model such as well-formed transactions, authentication, separation of duties and auditing can be used to secure the EHR. Originality/value Although previous studies have been based on a combination of RBAC and ABAC, this study also uses key concepts of the Clark-Wilson model for securing the EHR. Countries implementing the EHR can use the model proposed by this study to help secure the EHR while also providing EHR access in a medical emergency.

show abstract