RBAC Model Research Articles

A Workflow-based RBAC Model for Web Services in Multiple Autonomous Domains

A workflow-based RBAC model for web services (WFRBAC4WS) has been proposed in this paper. The model organizes web services in different autonomous domains through workflow mechanism, and maps RBAC model to tasks of workflow model. The paper details the authorization procedure of WFRBAC4WS model, the lifetime management, the extension of authorization constraint and the formal descriptions of the proposed model. Compared with other RBAC models for web services, this model not only combines RBAC model to workflow, but also describes the interactions between workflow mechanism and RABC model in web services environment, the authorization work of this model is dynamically and comprehensively.

A cognitive RBAC model with handover functions in small heterogeneous networks

In communication networks, a cognitive network (CN) is a new type of data network which is used to solve some of the problems that face current networks. Cognitive radio (CR) is part of a cognitive network and a smart wireless communication system. CR is conscious of its surrounding environment, learns from the environment and adapts its internal states by making corresponding real-time changes in certain operating parameters. In this paper, we propose a Cognitive RBAC scheme which can be applied to Small Heterogeneous Networks (SHNs) with handover function. We propose the Cognitive RBAC model applying with handover function in SHNs by extending from the well-known RBAC model. The required definitions for the model are proposed in this paper. They can increase the ability of the conventional RBAC model to meet new challenges. In our scheme, we assume that Cognitive Server (CS) provides and manages the permissions of services, and also supports a variety of CRs and CNs. For more efficiently managing CR and CN and meeting the SHNs, we let a mobile user actively perceive current network situations to get permissions and access corresponding services under the negotiation made among CSs to get better QoS if handover occurs either by Inter-CS Handover or Intra-CS Handover. In this paper, the cognitive RBAC functions and their definitions are proposed and defined for new applications in a SHN environment.

Model of Domain based RBAC and Supporting Technologies

Nowadays the significance of the access control technology in service oriented network is increasingly highlighted. The RBAC access control model has a variety of advantages such as easy management and high efficiency. With the expansion of the network scale, a network must be divided into autonomous multi-domains for convenient management. However, there is still a lack of studies on the domain based RBAC model as the barrier of applying the RBAC to multi-domain environment, and the corresponding supporting implementation technologies for the domain based RBAC are also in weak. In this paper, we proposed a model of domain based RBAC (D-RBAC) to better adapt to the security requirements of the multi-domain environment. We firstly introduced the domain concept and model and then gave a formal description to the proposed D-RBAC model. Secondly, we designed feasible implementation architecture for the D-RBAC model and based on this architecture we proposed two supporting technologies. The fuzzy role mapping method according to user’s attributes has strong description abilities for role assignment and the convenience of realization. The dynamic collaboration domain construction framework can greatly improve the efficiency of inter-domain access control. The proposed D-RBAC model and the related supporting technologies can obviously facilitate the application of RBAC in multi-domain environment

Trust Based Access Control Policy in Multi-domain of Cloud Computing

Cloud computing is a new paradigm which enables users to reduce their costs and is advantageous to both the serving and served organizations. However, security issue is a major concern in the adoption of cloud computing. The most effective way of protecting cloud computing services, resources and users is access control. This paper intends to provide a trust-based access control mechanism for cloud computing considering its multi-domain aspects. Firstly, trust is introduced into cloud computing environment and trust relationships between users and cloud platform are built. It also analyzes the difference between intra-domain trust and inter-domain trust. Furthermore, a role-based access control framework combined with trust degree in multi-domain is given from this paper. Access control in local domain directly applies RBAC model combined with trust degree, whereas in multi-domain it contains the conception of role translation. The simulation results show that the proposed method is more suitable to cloud environment and definitely can improve the reliability and validity of the system.

An effective and secure web banking system: development and evaluation

This paper provides a state-of-the-art approach to the development of an effective and secure web banking system. First, it presents the latest trends and advancements on web system development and operational requirements of e-banking environments. Then, it presents a prototype web banking system by providing its analysis and design based on the waterfall model through the use of workflow and UML diagrams, as well as its implementation approach based on web programming technologies such as active server pages and web services. The system development gives emphasis on security standards, by using the SSL protocol, the security techniques that are provided by the.Net framework, and a role-based access control RBAC model. At the end, a multi-perspective system evaluation, which is based on the balanced scorecard method, proves the high applicability and significant value of the proposed system.

Modelling context-aware RBAC models for mobile business processes

In a mobile computing environment, distributed business processes are executed in varying contexts. Context-aware access control mechanisms help to protect sensitive data and services in mobile application scenarios. Context constraints are a means to consider context information in access control decisions. In this paper, we integrate context constraints with process-related role-based access control RBAC to support the secure and context-dependent task execution. In particular, we specify a formal metamodel for process-related and context-aware RBAC models. Subsequently, we define a domain-specific extension for UML Activity diagrams that enables the integrated modelling of context constraints and business processes. In addition, we implemented a software platform that enables the specification and enforcement of process-related context-aware RBAC policies.

Application of RBAC Model in System Kernel

In the process of development of some technologies about Ubiquitous computing, the application of embedded intelligent devices is booming. Meanwhile, information security will face more serious threats than before. To improve the security of information terminal’s operation system, this paper analyzed the threats to system’s information security which comes from the abnormal operation by processes, and applied RBAC model into the safety management mechanism of operation system’s kernel. We built an access control model of system’s process, and proposed an implement framework. And the methods of implementation of the model for operation systems were illustrated. DOI: http://dx.doi.org/10.11591/telkomnika.v10i7.1449 Full Text: PDF

An Effective Approach for Fine-Grained RBAC Model Based on AOP

we propose an effective approach for fine-grained RBAC model by using AOP. The proposed approach can effectively accomplish the general role-based access control functions among enterprise application systems. This approach focuses on the fine-grained access control and is implemented by using interceptor technique of Java Struts2. We also present the related architecture and applied system (Project Management Platform of DUT Infrastructure Construction) for a verification of this proposed approach.

Design and Implementation of a CIM-SPL Based RBAC Policy Language

Since the original CIM-SPL policy language does not support access control policy, the CIM-SPL is extended with the RBAC model in this paper. Then a new CIM-SPL based RBAC policy language is designed and implemented. The syntax specification of the new policy language complies with the original CIM-SPL. So it is quite suitable to describe access control policies for information systems specified by CIM. The implementation framework of the new access control policy language is based on the IETF PDP/PEP approach and is integrated in the Open Pegasus system which is the most widely used open-source software of CIM implementation. At last, a case study of Health Information System is used to demonstrate the flexibility and applicability of the new access control policy language.

Study of Access Control Issue in Web Services

Security is an important issue that must be well-defined in Service Oriented Architecture (SOA) environment, so that it could be used in implementing the web services. In this article, we focus on one of the important aspects of SOA security, which is access control. The article explains the security requirements that must be followed and proposes a conceptual model of requirements in this field based on the needs. Then every requirement, available techniques and standards in this field is separated and discussed. Since different models such as IBAC,RBAC, ABAC and RAdAC have been presented so far, these existing models are explained. Then a comparison between ABAC model’s structure that is more compatible with SOA and RBAC model that is most widely used today is presented. General Terms Service Oriented Architecture; Distributed System; Web Services; Access Control; Security, et. al.

Role-Based Access Control in Retrospect

A review of the state of the art of role-based access control can help practitioners assess RBAC's applicability to their organization and indicates where more research is needed to improve the RBAC model.

Role-based Trust Management Model in Multi-domain Environment

Based on the in-depth analysis of issues in dRBAC model, which include the lack of commission depth control in distributed environment, the inefficiency of cascading revocation of the authorization roles and the incapability of judging whether the commission violates the principles of RBAC model before it is done, this paper proposed MD-dRBAC Model, designed trust management mechanism for MD-dRBAC Model, which was used to control the access, established the credible authority commission tree and finally proposed the detection algorithm for implicit authorities upgrading to avoid violation of the least privilege principle in RBAC model Extensive security and performance analysis show that the proposed schemes are highly efficient and secure. DOI: http://dx.doi.org/10.11591/telkomnika.v11i1.1917

Application of Improved RBAC in System Login Component Design

With the development of computer technology, the importance attached to the security of computer application systems is increasing day by day. Access control, as an important security technology, has been applied in the operating system, the database management system, security management and network operating system etc. This paper adopt the system ideology of high cohesion and low coupling in software engineering, achieve the design of login component by improving RBAC model under .NET platform, the model increases mechanism of direct authorize the users and shield part of users’ authority based on authorize main role, enriches the old RBAC mode of controlling authority, avoids the illegal operation of users, make sure the security of the system. Meanwhile, the component is well designed, and can be easily used as login component in large systems.

Static and Dynamic Delegation in the Role Graph Model

Delegation in access control is used to deal with exceptional circumstances, when a regular user is unable to perform their normal job and delegates all or part of it to others. These situations can be anticipated and built into the security design as static delegation; however, unforseen circumstances can still occur requiring dynamic delegation to be specified at runtime. This paper presents both static and dynamic delegation in the context of the Role Graph Model. To properly capture runtime events, we add sessions to the RGM. We then introduce session-oriented, dynamic delegation, a new concept in RBAC models, using an edge-labeling method. Constraints applicable to both static and dynamic delegation are examined.

Runtime Administration of an RBAC Profile for XACML

The eXtensible Access Control Markup Language (XACML) is the de facto language to specify access control policies for web services. XACML has an RBAC profile (XACML-RBAC) to support role-based access control policies. We extend this profile with an administrative RBAC profile, which we refer to as the XACML-ARBAC profile. One of the advantages of doing so is to use policies based on RBAC model to administrate XACML-RBAC policies. Because using permissions granted by XACML-ARBAC policies alter XACML-RBAC policies, enforcing XACML-ARBAC polices requires some concurrency control within XACML access controller's runtime. In order to solve this concurrency problem, we propose a session-aware administrative model for RBAC, and enhance the XACML policy evaluation runtime using a locking mechanism. Experimental study shows reconcilable performance characteristics of our enhancements to Sun's XACML reference implementation.

H-RBAC: A Hierarchical Access Control Model for SaaS Systems

SaaS is a new way to deploy software as a hosted service and accessed over the Internet which means the customers don't need to maintain the software code and data on their own servers. So it's more important for SaaS systems to take security issues into account. Access control is a security mechanism that enables an authority to access to certain restricted areas and resources according to the permissions assigned to a user. Several access models have been proposed to realize the access control of single instance systems. However, most of the existing models couldn't address the following SaaS system problems: (1) role name conflicts (2) cross-level management (3) the isomerism of tenants' access control (4) temporal delegation constraints. This paper describes a hierarchical RBAC model called H- RBAC solves all the four problems of SaaS systems mentioned above. This model addresses the SaaS system access control in both system level and tenant level. It combines the advantages of RBDM and ARBAC97 model and introduces temporal constraints to SaaS access control model. In addition, a practical approach to implement the access control module for SaaS systems based on H-RBAC model is also proposed in this paper.

Provably Secure Role-Based Encryption with Revocation Mechanism

Role-Based Encryption (RBE) realizes access control mechanisms over encrypted data according to the widely adopted hierarchical RBAC model. In this paper, we present a practical RBE scheme with revocation mechanism based on partial-order key hierarchy with respect to the public key infrastructure, in which each user is assigned with a unique private-key to support user identification, and each role corresponds to a public group-key that is used to encrypt data. Based on this key hierarchy structure, our RBE scheme allows a sender to directly specify a role for encrypting data, which can be decrypted by all senior roles, as well as to revoke any subgroup of users and roles. We give a full proof of security of our scheme against hierarchical collusion attacks. In contrast to the existing solutions for encrypted file systems, our scheme not only supports dynamic joining and revoking users, but also has shorter ciphertexts and constant-size decryption keys.

Some New Security Strategies Description about Grid

The security strategy description is important contents of security access control research about grid. The strategy of traditional access control models has ignored the subject security, and can not be solved with the dynamic grid, and the characteristics of the coexistence of multiple security strategy etc problems. Regarding the concept of subject/ object decomposition and the organization classifications are defined, and the concepts of subject safe service, object safe service, and granularity control etc are expanded, Using the RBAC model and BLP the model basic principle, a group new access control security strategy based on the grid environment have be given in the paper. After discussion shows that the new rules emphasis on the subject security, and adapt to the dynamic nature of grid environment and characteristics of the coexistence of multiple security strategy. The new rules are compatibility with existing network access control model, they are secure and are also an expansion under the common network environment access control strategy, and this has certain positive significance to the grid security research.

Situation, Team and Role based Access Control

Problem statement: An emergency system of sharing and exchanging user’s personal information is demanded in medical treatment and disaster situations. Approach: In such a system, personal information access control depending on user situations is greatly necessary. However, it is complicated to manage personal information access control directly, because the existing access control methods only support regular access control, not for an emergency case. Results: In this study, we propose a new access control model, called STRAC, which stands for Situation, Team and Role based Access Control. The STRAC enables access control of user personal information with consideration of context changes. Conclusion/Recommendations: In our proposed model, a concept of situations is introduced. Moreover, the proposed model is based on a concept of TMAC, which is an extension of a conventional RBAC model.

Cardinality Constraint Access Control Model and Implementation

Analysis constraints and its diversity in security access control model. Cardinality is a common constraint in access control model. An extended cardinality constraint access control model is established. According to actual demand, we describe the user-role, user-session, role-session cardinality constraints based on the RBAC model. The differences between static and dynamic cardinality constraints are also represented particularly. Describe the extended model with Schema based XML and extend corresponding model functional specification. In order to support the extended model, we give an implementation structure including access control management and query functions.