Enforcement of Role Based Access Control in Social Network Environments

Abstract

Role-based access control (RBAC) policies have been implemented in many social network environments to enforce the security. However, enforcing RBAC policies in a social network environment also brings the design complexity and potential security vulnerabilities which may cause insecure information flows. In this paper, we present a framework for formally modeling and analyzing RBAC policies using high level Petri nets and model checking techniques. The high level Petri nets called PZ nets that have been developed based on Predicate/Transitions nets and Z notation have significant benefits for modeling security models through combining modeling capacities from both formalisms, and the analysis technique based on model checking tool SPIN provides an automatic conformance checking of RBAC policies in applications. A case study of the enforcement of RBAC policies in an online file sharing system is performed to demonstrate the effectiveness of the proposed approach.