Role-based access control

Giuri, Luigi

doi:10.1145/270152.270176

Cited by 20 publications

(17 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…4 Early contributions focus on the identification of future research areas and developments while later articles commonly analyze the historical development of specific role-related research issues. The first metaanalyses identified the refinement and development of the nature of RBAC as well as the practical implementation of RBAC as major research areas (Ferraiolo and Kuhn, 1996;Giuri, 1996). A marketing survey of Smith et al (Smith, 1997;Smith et al, 1996) focused on customer requirements regarding their security needs for information processing systems.…”

Section: 2mentioning

confidence: 99%

Roles in information security – A survey and classification of the research area

Fuchs

Pernul

Sandhu

2011

Computers & Security

View full text Add to dashboard Cite

show abstract

Section: 2mentioning

confidence: 99%

Roles in information security – A survey and classification of the research area

Fuchs

Pernul

Sandhu

2011

Computers & Security

View full text Add to dashboard Cite

show abstract

“…Several researchers have addressed issues related to inheritance semantics in RBAC [Giuri 1995], [Giuri 1996], [Moffett 1998], [Nyanchama and Osborn 1999], [Sandhu 1996], [Sandhu 1998]. Our earlier work has addressed issues concerning the inheritance relation when temporal properties are introduced [Joshi et al 2002].…”

Section: Related Workmentioning

confidence: 99%

“…Sandhu's notion of activation hierarchy extending the inheritance hierarchy corresponds to the IA-hierarchy and our A-hierarchy corresponds to Sandhu's relation that relates two roles by activation hierarchy but not by inheritance semantics [Sandhu 1998]. In [Giuri 1995], [Giuri 1996], Giuri has proposed an activation hierarchy based on AND and OR roles. However, these AND-OR roles can be easily simulated within Sandhu's ER-RBAC96 model that uses usage and activation hierarchies, making Giuri's model a special case of ER-RBAC96 [Sandhu 1998].…”

Section: Related Workmentioning

confidence: 99%

“…Role based access control (RBAC) has emerged as a promising alternative to traditional discretionary and mandatory access control (DAC and MAC) models [Giuri 1995], [Giuri 1996], , [Nyanchama and Osborn 1999], [Osborn et al 2000], , [Koch et al 2002], which have inherent limitations . Several beneficial features such as policy neutrality, support for least privilege and efficient access control management are associated with RBAC models [Ferraiolo et al 1993], , .…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Formal foundations for hybrid hierarchies in GTRBAC

Joshi

Bertino

Ghafoor

et al. 2008

ACM Trans. Inf. Syst. Secur.

View full text Add to dashboard Cite

A role hierarchy defines semantics related to permission acquisitions and role activations through role-role relationships. It can be utilized for efficiently and effectively structuring functional roles of an organization having related access control needs. Temporal constraints on role enablings and role activations can have various implications on such a role hierarchy. The focus of this paper is the analysis of hybrid role hierarchies in the context of the Generalized Temporal Role Based Access Control (GTRBAC) model that allows specification of a comprehensive set of temporal constraints on role, user-role assignments and role-permission assignments. We introduce the notion of uniquely activable set (UAS) associated with a role hierarchy that indicates the access capabilities of a user resulting from his membership to a role in the hierarchy. Identifying such a role set is essential while making an authorization decision about whether or not a user should be allowed to activate a particular combination of roles in a single session. Furthermore, when separation-of-duty (SoD) constraints are present in the system, it is also essential to ensure that there are no role combinations that can be allowed to be activated in a single user session. In other words, knowledge about UAS can be used to facilitate enforcement of the principle of least privilege. Because of the separation of permission inheritance and role activation semantics in GTRBAC, a hybrid hierarchy that allows different hierarchy types to coexist, can give rise to a complex semantics and identifying what role combinations can be allowed to be activated in a session for a user may not be straight forward. We formally show how UAS can be determined for a hybrid hierarchy. Furthermore, within a hybrid hierarchy, various hierarchical relations may be derived between an arbitrary pair of roles. We present a set of inference rules that can be used to generate all the possible derived relations that can be inferred from a specified set of hierarchical relations and show that the set of these inference rules is sound and complete. Another key issue we address in this paper is that of the evolution of role hierarchies through hierarchical transformations. We present an analysis of hierarchy transformations with respect to role addition, deletion and partitioning, and show how various cases of these transformations allow the original permission acquisition and role activation semantics to be managed. The formal results presented here provide a basis for developing efficient security administration and management tools.

show abstract

“…As discussed in the introduction, most real-world RBAC systems now provide parameterisation; early examples include [1,9,10,12]. This trend has been further reinforced by the specific parameterised models present in the NIST RBAC standards [15].…”

Section: Related Workmentioning

confidence: 99%