RBAC Model Research Articles

Research on Access Control Strategies for Medical Data Interaction Platform Based on Cloud Services

Cloud computing technology is widely used in the field of medical information, providing strong technical support for the information construction of medical and health institutions, but at the same time it also brings privacy disclosure of medical data and hidden dangers of medical information insecurity. Control is one of the key technologies in the privacy and security protection of medical data in cloud services. This paper aims at the limitations of the RBAC model applied to the SaaS model, improves it, and proposes a Service-Oriented Multi-tenant Access Control (SMTAC) strategy to meet the needs of the software rental service to provide security for multiple healthcare organizations in the region at the SaaS model.

Extended Request-oriented Role Access Control Model for Web Applications

This work is dedicated to developing security access control model for web applications. Our work is focused on RBAC model described by Ferraiolo and Kuhn [1992] and Sandhu [1998]. This article describes the new request-oriented RBAC model, which allows flexible access control using web request path and parameters. The new model is a development of our previous extended path-based RBAC model and provides additional access control capabilities. Applying this new model allows reducing security risks for web applications.

Rule Adaptation in Collaborative Working Environments using RBAC Model

Collaborative Working Environments (CWEs) are getting prominence these days. With the increase in the use of collaboration tools and technologies, a lot of sharing and privacy issues have also emerged. Due to its dynamic nature, a CWE needs to adapt the changes into accordingly. In this paper, we have implemented the Adaptive Dynamic Sharing and Privacy-aware Role Based Access Control (Adaptive DySP-RBAC) model which provides user’s information privacy to dynamically adapt the changes occurring in the system at any time. The proposed model has been implemented as a prototype and tested. Results have shown that our system efficiently and effectively adapts access rules according to the changes happening in a CWE along with preserving the user’s information privacy in the system.

A Flexible Solution for Privilege Management and Access Control in EHR Systems

Background: Inter-organizational healthcare businesses are ruled by a huge set of policies: legal policies, organizational policies, medical policies, ethical policies, etc., which are quite static, patients policy and process, social and environmental conditions, which are highly dynamic. In the context of a business case, those diff erent policies must be harmonized to enable privilege management and access control decisions. Objectives: The authors off er a methodology to achieve interoperability through policies harmonization in a privilege management and access control solution for EHR systems, to be later on implemented in a cancer care network using HL7 specifications. Methods: To meet the objective, the authors make use of a system-theoretical, architecture-centric, ontology-based approach to formally representing the aforementioned polices for harmonization. Results: Because of its fl exibility and generality, a policydriven RBAC model is used to formally represent all the other access control models such as MAC, DAC, RBAC, ABAC, HL7 Data Segmentation and Labeling Services. All the policies deployed in the context of an inter-organizational collaboration for cancer care can be formalized and then harmonized. Conclusions: The authors provide an implementation independent methodology to enable policies harmonization in EHR systems. The methodology described in the paper is independent on the maturity of organizations’ privilege management and access control system. Furthermore, it does not hamper organizations progressing to more advanced solutions over the time. Even dynamic policies can be harmonized at run time, allowing advancement towards a patient-centered care.

Application of Privacy-aware Role-based Access Control Model in IHE-XDS

Integrating the Healthcare Enterprise (IHE)’s Cross-Enterprise Document Sharing (XDS) profile is an open standards-based architecture specification for EHR systems. In EHR systems, it is necessary to provide a mechanism for access control to protect security and privacy of patient data. On the basis of related studies, this paper addresses the issue of access control and privacy protection of privacy data in XDS-based EHR systems, aiming to identify a suitable, privacy-aware role-based access control model based on specific access requirements for IHE-XDS. Privacy-aware role-based access control model is an extension model of RBAC model. It not just has the benefits of RBAC, but additionally adds restrictions on the permission assignment for the roles by using the purpose enforcement and privacy-aware access control enforcement. The proposed model could further protect privacy data, while decreasing the complexity of the role assignment.

System security model based on trusted access control under cloud computing environment

It has become a hot spot of cloud security to provide good service for legal user, and prevent access from illegal user or illegal access from legal user. Therefore, it is urgent to design a reasonable access control security model under cloud computing. This paper discusses trust definition and computation in cloud computing environment and uses scientific methods to compute comprehensive trust degree. Then based on RBAC model the conception of trust is introduced to form a trust-based access control model. The security model satisfies the design for access control mechanism in opened system, by establishing indirect user-role distribution relation and context constrain which reflecting context information. The formal definition and access control policies of the model are explained. The scheme can dynamically determine the authorisation according to the user's trust value, so it can detect the user's abnormal behaviour at any time and respond in a timely manner. The simulations shows this model can effectively help users in cloud service to make choices on security and reliability, and it also shows better dynamic property to prevent abnormal behaviours of the users.

Towards Attribute-Centric Access Control: an ABAC versus RBAC argument

Recent developments in attribute-based access control have fueled the conventional debate regarding the pros and cons of Attributes-based access control ABAC versus Role-based access control RBAC. However, existing arguments have been primarily focused on the complexity analysis of the two models instead of their comprehensive need analysis. On the contrary, the success and evolution of RBAC as a de-facto access control model is based on the thorough need analysis of using roles as a primary decision factor for controlling access. Analogously, we need to consider the application areas for comparing the use of role-based and attribute-based approach. In this regard, our work aims to bridge the gap between the RBAC and the ABAC proponents by convincing the RBAC supporters of the effectiveness of ABAC. We identify various inherent traits of RBAC which have eventually become its limitations in addressing future access control needs for providing flexible, fine-grained, multifactor, and anonymous authorization in dynamically changing and context sensitive environments. These limitations are usually addressed either through extended RBAC models or ABAC model. We analyze the two approaches with respect to their effectiveness in overcoming the identified limitations and draw the conclusion that the attribute-centric approach is the ultimate future of access control. Copyright © 2016 John Wiley & Sons, Ltd.

Safeness Discussions on TRBAC and GTRBAC Model and an Improved Temporal Role-Based Access Control Model

Bertino et al. propose a temporal Role-based Access Control (TRBAC) model, and Joshi et al. propose a Generalized TRBAC (GTRBAC) model based on TRBAC. Some periodic constraints and duration constraints are introduced to express the corresponding time-based access control policy semantics and enhance the expressiveness of the temporal RBAC model. We have analyzed the TRBAC and GTRBAC models and pointed out that the sufficient conditions for guaranteeing the safeness of the GTRBAC model was not comprehensive, so we have analyzed the reasons and designed a process rule to solve the safety problem. In this paper, an improved process rule is designed to solve the safety problem. In addition, a fault about translating a dependent trigger of TRBAC into an Oracle trigger is analyzed. In order to ensure the temporal RBAC model better, an Improved Generalized Temporal Role-based Access Control (IGTRBAC) based on the TRBAC and GTRBAC models is put forward. The two proposed restrictions in the IGTRBAC model are used to resolve the security problems caused by the dependent trigger and the cardinality constraint on role activation. At last, case study shows that the IGTRBAC model is safe.

Quantitative Analysis Method of EXRBAC Model withN-Dimensional Security Entropy

On how to evaluate the performance of access control models, a method ofN-dimensional security entropy is described in this paper. According to the definition and description of the information entropy in information theory, the definition of the One-dimensional Security Entropy is introduced and the one-dimensional security entropy in Discretionary-access Control model is discussed firstly. Then theN-dimensional security entropy is extended based on the unauthorized access, and by means of theN-dimensional security entropy, the quantitative security performance is measured in RBAC model. In order to measure the security of management information system with complex role level, an extension of RBAC access control (EXRBAC) model is presented in this paper, which could get quantitative analysis withN-dimensional security entropy methods. Through analyzing and comparing the security performance of these three access control models, it is shown that the EXRBAC model performance is improved in multi-class and multi-level roles condition.

An Improved RBAC Model and its Application in Development of Information System

Aiming at the deficiencies of traditional RBAC model, on the basis of studying of the models introduced in the literatures published, this paper puts forwards an improved model--MR-RBAC, including its concepts and design. This model is implemented by adding restriction strategy on the operation objects and data objects, assignment different privileges to different users via configuration mapping of functions and menus. The implementation and practice indicates that the MR-RBAC model not only simplifies privilege management, but also improves the system security and privileges management flexibility.

OB4LAC: An Organization-based Access Control Model for E-government System

Following the emergency of multi-level, complex and distributed information systems, the traditional RBAC model becomes more and more weak and incompetent. Currently, the research of RBAC model mainly focused on building a suitable role hierarchy, although played a certain effect it still have many problems. Through the research aiming at organizations and their characters, we believe that the reasons that cause the present problems are due to the conflict in working patterns between the RBAC model and the physical world. Thus, we propose a new access control method-Organization Based Access Control Method and the specific model- OB4LAC model. This article analyzes the constituent members, formal specification, sub-models UPA, PORA, PERA and RRA of OB4LAC, and also gives the specific process in access operations and business collaboration among multi-organizations. Through the test in many complex E-government systems, OB4LAC model achievesgood results.

Research of Multilevel Security Network Based on Mobile IPv6

multilevel security technology has broad applications in military and commercial aspects, the key technology in the research of multilevel security network, based on the BLP model of a security enhancement model is presented, and proved its security of the model. Secondly, based on the analysis of RBAC96 model cluster, proposes a licensing scheme of multilevel mobile IPv6 network based on role. Again gives an implementation scheme of multilevel security network in mobileIPv6 network environment. Including the configuration and deployment of mobile IPv6 environment of multilevel security network, and gives the process of multilevel security network. Finally, the simulation results of multilevel security network is given. The results show that, the multilevel security network design to meet the functional requirements of multilevel security network.

Validation of IS Security Policies Featuring Authorisation Constraints

Designing a security policy for an information system (IS) is a non-trivial task. Variants of the RBAC model can be used to express such policies as access-control rules associated to constraints. In this paper, we advocate that currently available tools do not take sufficiently into account the functional description of the application and its impact on authorisation constraints and dynamic aspects of security. The authors suggest translating both security and functional models into a formal language, such as B, whose analysis and animation tools will help validate a larger set of security scenarios. The authors describe how various kinds of constraints can be expressed and animated in this context. The authors also present a tool support which performs this translation and report on a case study where animation and testing techniques were used to validate the security policy of a medical emergency information system.

Realization of Improved RBAC Model in Task Management in Normative Concepts Collaborative Construction Platform

Realization of Improved RBAC Model in Task Management in Normative Concepts Collaborative Construction Platform

Contract RBAC in cloud computing

Cloud computing is a fast growing field, which is arguably a new computing paradigm. In cloud computing, computing resources are provided as services over the Internet and users can access resources based on their payments. The issue of access control is an important security scheme in the cloud computing. In this paper, a Contract RBAC model with continuous services for user to access various source services provided by different providers is proposed. The Contract RBAC model extending from the well-known RBAC model in cloud computing is shown. The extending definitions in the model could increase the ability to meet new challenges. The Contract RBAC model can provide continuous services with more flexible management in security to meet the application requirements including Intra-cross cloud service and Inter-cross cloud service. Finally, the performance analyses between the traditional manner and the scheme are given. Therefore, the proposed Contract RBAC model can achieve more efficient management for cloud computing environments.

The Research of Group Hierarchy Access Control in E-Government System

In order to meet the requirements of E-Government System with complex user relationships and diversified business process , this paper proposed an advanced RBAC model named Group Hierarchy Role-Based Access Control (GH-RBAC). In this model, tradition user role assignment have been reformed to multilayer user group role group assignment which improve the scalability and adaptability of access control. Finally, we design and implement the extend model which emphasis the way to carry out access control module with the low coupling.

Roles Generation for Applications in RBAC Model

RBAC has been widely used for the reason of its efficiency, convenience and safety. But as the traditional user-oriented access control strategy, the RBAC carries the disadvantage of user-oriented access control as well. It always assumes that the application is credible and the behavior of the program represents the wishes of the user. However, this assumption is increasingly proving to be false and numbers of prevalent types of security attacks leverage this weakness to misuse the authority of users. Based on RBAC and learn from the concept of FBAC, this paper will proposed a solution about generating roles for application.

Privacy-aware RBAC model for web services composition

Web services collaborative environments are highly automatic, dynamic, and heterogeneous. These characteristics always lead to high risks of services for interaction participants. Hence, it becomes one of the most important things to guarantee that the private information in cross-domain services is not illegally collected, used, disclosed or stored when the Web services are required to combine secure composition. This paper proposes the privacy-aware role based access control model for Web services composition (WSC-PRBAC), which provides protection for private data of users in composite service. The element services are divided into local services and outside services. Because the local service is authorized by users, it is exactly different from other services in the composition. To avoid sending private information to other outside services directly, we define global roles to help access these data in local service. Using global roles can realize a more strict control of the private data. In the end, the experiment and analysis of the proposed model show its and efficiency.

An ASP Based Approach of Inter-Domain Role Mapping

Although the ANSI RBAC model has achieved great success in the enterprise, it provides no mechanism for the urgent interoperation needs between distributed domains. This paper presents an ASP based approach to extend traditional RBAC model for inter-domain cooperation. We first translate the RBAC models with the IDRM problem into answer set programs, and then compute the solutions via an answer set solver. Finally, we discuss the safety and availability of our approach and ensure the models conflict-free. It is concluded that our approach supports the collaborating environments well with flexible and efficient reasoning abilities.

The RBAC model and implementation architecture in multi-domain environment

Nowadays in the IT convergence environment, the Service Oriented Architecture has its unique significance. The RBAC model has a variety of advantages in protecting the security of services. When the network is extended to a certain scale, it must be divided into multi domains for convenient management. However, the study to the RBAC model can be applied in multi-domain environment is still lacked. Corresponding feasible implementation architectures for the individual and composite services are also in weak. In this paper, we proposed a domain model and a domain based RBAC model can better adapt to the multi-domain security requirements. Then based on the model we designed feasible and efficient access control architectures respectively focusing on the individual services and different type of composite services. The evaluation cases showed the proposed model and implementation architectures achieved desired effects and the performances are in promising.