Role-based Access Control Features Research Articles

Enterprise WAE: A Lightweight UML Extension for the Characterization of the Presentation Tier of Enterprise Applications with MDD-Based Mockup Generation

Nowadays, the Unified Modeling Language (UML) is the most successful notation for the design of object-oriented applications. However, plain UML is not enough to characterize the web presentation tier of enterprise applications, including the navigational, structural and role-based access control (RBAC) features present in these applications. In this paper, we present Enterprise Web Application Extension (E-WAE), a lightweight UML extension for the modeling of these elements, which permits the inclusion of multitier, Service-Oriented Architecture (SOA) and security design-level patterns in the models. Our approach follows a Model-Driven Development (MDD) approach, which enables the automatic generation of intermediate platform-specific models and automatic code generation for JavaServer Faces (JSF) and Active Server Pages.NET Model-View-Controller (ASP.NET MVC) frameworks. In addition, this generated code can be used as a low-cost mockup for early client validation of the navigational, structural and RBAC features of enterprise applications. E-WAE has been used with different applications. In this paper, we refer to the checkout process in the Amazon website, the delete resources use case in OdAJ2EE, an educational application developed by us, and the US Library of Congress Online Catalog search facility as examples of its applicability.

An Improved Role Based Trust Management System using Interactive Artificial Bee Colony (I-ABC) Algorithm for Wireless Sensor Networks

The aim of this research study is to propose an improved role based trust management system for wireless sensor networks. The objective is attained using an interactive artificial bee colony algorithm which is used for path optimization. Also the purpose is to guarantee to provide robust and trustworthiness among the clusters formed in the wireless sensor network. The reputation among the sensor nodes is assured using the trust model. One of the main concerns of WSN, that have attracted research scholars, is the property to guarantee a less amount of security in a limited environment. Trust among the communicative nodes is one of the major issues that have to be given importance in wireless sensor network. A number of research works have concentrated on only Trust Management (TM) techniques without considering their roles. Existing trust management schemes do not provide significant reliability in all environments. In order to overcome these issues, Role Trust (RT) framework is presented, to select role for each nodes representing policies in a distributed authorized environment. RT integrates the features of role-based access control and TM schemes. This feature is particularly applicable for attribute based access control. Role trust management schemes generate rules, identify and assure roles based on the rules generation process and then clusters are identified for each trust model. Along with the trust model, this study focuses on efficient data path with reduced data loss. Hence, this study presents a novel Swarm Intelligence based Role Trust and Reputation Model (SIRTRM) to provide trust and reputation in WSNs. Simulations are carried out in NS2 environment and the results portrays the accuracy, robustness and lightness of the proposed model.

Enhanced Role based Access Control: Integrating Auditing and Authentication

In past decade lot of research has been done in RBAC (Role Based Access Control) technology. The industries have also shown great interest in RBAC. Most of the IT vendors are offering products that incorporate some form of RBAC. Today, all major DBMS products support RBAC. RBAC provides easier management of permissions in an organization and hence is most widely used model to control access of legitimate users. However research shows that access control is not a complete solution for securing a database. Most of the breaches are done by insiders. So, access control system must be incorporated with other mechanisms that provide more features than just controlling access of users. Auditing is such a mechanism that can log all the transactions occurring on the database and based on this log an analysis can be done. Auditing is well effective when we have good authentication. Authentication processes are vulnerable to SQL Injection attacks. This paper proposes an enhanced model that increases the capability of RBAC model by integrating Auditing and Authentication in simplest ways. In this way this model not only provides the features of RBAC but also handles common issues of database security.

Reliability of separation of duty in ANSI standard role-based access control

ANSI RBAC is a standard for a consistent and uniform definition on Role Based Access Control features and their functional specifications ANSI (2004) [1]. We analyze both static and dynamic separation of duty constraints specifications in the ANSI RBAC standard and evaluate their reliabilities. We then suggest necessary improvements for making them completely reliable.

A feature-based approach for modeling role-based access control systems

Abstract Role-based access control (RBAC) is a popular access control model for enterprise systems due to its flexibility and scalability. There are many RBAC features available, each providing a different function. Not all features are needed for an RBAC system. Depending on the requirements, one should be able to configure features on a need basis, which reduces development complexity and thus fosters development. However, there have not been suitable methods that enable systematic configuration of RBAC features for system development. This paper presents an approach for configuring RBAC features using a combination of feature modeling and UML modeling. Feature modeling is used for capturing the structure of features and configuration rules, and UML modeling is used for defining the semantics of features. RBAC features are defined based on design principles of partial inheritance and compatibility, which facilitates feature composition and verification. We demonstrate the approach using a banking application and present tool support developed for the approach.

Security-Enhanced OSGi Service Environments

Today's home and local-area network environments consist of various types of personal equipments, network devices, and corresponding services. Since such prevalent home network environments frequently deal with private and sensitive information, it is crucial to legitimately provide access control for protecting such emerging environments. As a result, the open services gateway initiative (OSGi) attempted to address this critical issue. However, the current OSGi authorization mechanism is not rigorous enough to fulfill security requirements involved in dynamic OSGi environments. In this paper, we provide a systematic way to adopt a role-based access control (RBAC) approach in OSGi environments. We demonstrate how our authorization framework can achieve important RBAC features and enhance existing primitive access control modules in OSGi service environments. Also, we describe a proof-of-concept prototype of the proposed framework to discuss the feasibility of our approach using an open source implementation of OSGi framework known as Knopflerfish.

A Critique of the ANSI Standard on Role-Based Access Control

In 2004, the American National Standards Institute approved the Role-Based Access Control standard to fulfill need among government and industry purchasers of information technology products for a consistent and uniform definition of role based access control (RBAC) features. Such uniform definitions give IT product vendors and customers a common and unambiguous terminology for RBAC features, which can lead to wider adoption of RBAC and increased productivity. However, the current ANSI RBAC Standard has several limitations, design flaws, and technical errors that, it unaddressed, could lead to confusions among IT product vendors and customers and to RBAC implementations with different semantics, thus defeating the standard's purpose.

Proposed NIST standard for role-based access control

In this article we propose a standard for role-based access control (RBAC). Although RBAC models have received broad support as a generalized approach to access control, and are well recognized for their many advantages in performing large-scale authorization management, no single authoritative definition of RBAC exists today. This lack of a widely accepted model results in uncertainty and confusion about RBAC's utility and meaning. The standard proposed here seeks to resolve this situation by unifying ideas from a base of frequently referenced RBAC models, commercial products, and research prototypes. It is intended to serve as a foundation for product development, evaluation, and procurement specification. Although RBAC continues to evolve as users, researchers, and vendors gain experience with its application, we feel the features and components proposed in this standard represent a fundamental and stable set of mechanisms that may be enhanced by developers in further meeting the needs of their customers. As such, this document does not attempt to standardize RBAC features beyond those that have achieved acceptance in the commercial marketplace and research community, but instead focuses on defining a fundamental and stable set of RBAC components. This standard is organized into the RBAC Reference Model and the RBAC System and Administrative Functional Specification. The reference model defines the scope of features that comprise the standard and provides a consistent vocabulary in support of the specification. The RBAC System and Administrative Functional Specification defines functional requirements for administrative operations and queries for the creation, maintenance, and review of RBAC sets and relations, as well as for specifying system level functionality in support of session attribute management and an access control decision process.