An Adaptive Authorization Model Based on RBAC

Radu Constantinescu, Lucian Corlan

Abstract


In the article we present a data model and a possible implementation suited to allow proper access control in a system. In order to do that, we started from the extended RBAC model which is focused on roles which are associated to different functions existing in the system. The access control is implemented not just for some application’s functionalities but also for granulated data details, like data attributes.

Keywords


authorization, access control models, roles, security, RBAC

Full Text:

PDF

References


D.F. Ferraiolo and D.R. Kuhn (1992) "Role Based Access Control" 15th National Computer Security Conference, Oct, 1992

R. Sandhu, D.F. Ferraiolo, D, R. Kuhn "The NIST Model for Role Based Access Control: Towards a Unified Standard", NIST, 2000

D.F. Ferraiolo, D.R. Kuhn, R. Chandramouli, “Role Based Access Control” (book), Artech House, 2003, 2nd Edition, 2007

D.R. Kuhn, "Mutual Exclusion of Roles as a Means of Implementing Separation of Duty in Role-Based Access Control Systems" Second ACM Workshop on Role-Based Access Control, 1997

D.F. Ferraiolo, J. Barkley, D.R. Kuhn, "A Role Based Access Control Model and Reference Implementation within a Corporate Intranet", ACM Transactions on Information Systems Security, Volume 1, Number 2, February 1999.

Beznosov, Deng, Blakley, Burt, Barkley, "A Resource Access Decision Service for CORBA-based Distributed Systems", ACSAC (Annual Computer Security Applications Conference), 1999

R. Sandhu, D. Ferraiolo, R. Kuhn, "The NIST Model for Role Based Access Control: Towards a Unified Standard," Proceedings, 5th ACM Workshop on Role Based Access Control, July 26-27, 2000.

R.Chandramouli, "Specification and Validation of Enterprise Access Control Data for Conformance to Model and Policy Constraints", 7th World Multi-conference on Systemics, Cybernetics and Informatics, 2003

R. Constantinescu, A. Barbulescu, "Systems Security through Capability Models", "Competitiviness and European Integration" International Conference, Cluj, Romania, Oct, 2007

R. Constantinescu, F. Nastase, "Process Models for Security Architectures", Informatics in Economy Journal, no. 4, 2006

R. Constantinescu, I. Ilie-Nemedi, "eBusiness Security" poster session, 12th Intel EMEA Academic Forum, Budapest, 12-14 June 2007

Department of Defense Standard, "Trusted Computer System Evaluation Criteria", 1985

R. Sandhu, E. Coyne, H. Feinstein, "Role Based Acces Control Models“, IEEE Computer, 1995


Refbacks

  • There are currently no refbacks.


Journal of Mobile, Embedded and Distributed Systems (JMEDS) ISSN: 2067 – 4074 (online)