Spatio-temporal Role-based Access Control Research Articles

Enhancing user access information with spatial data

Enforcing proper access control is essential for ensuring the security of sensitive resources in an organization. Access control models like the Role-Based Access Control (RBAC) model, its various temporal, spatial as well as spatial and temporal extensions have been proposed for achieving this objective. Though several algorithms have been presented by researchers for implementing RBAC and temporal RBAC, to the best of our knowledge, no attempts have been made so far for deploying a spatial or spatio-temporal RBAC model in terms of either creating suitable datasets or algorithms. For doing this, we require user-permission assignment information containing location constraints that need to be subjected to role mining approaches to derive the spatially constrained roles. In this paper, we focus on bridging this gap by presenting a suitable representation for spatially constrained access information. We name it as Spatial User-Permission Assignment (SUPA) matrix. We also propose an approach for generating SUPAs which can serve as inputs for the spatially constrained role creation procedures. We name our proposed method as Spatial Access Dataset Enumeration (SPADE). SPADE can be easily utilized to generate datasets of varied sizes which can be used for the performance evaluation of different role creation algorithms. As experimental results, we report the structure of sample SUPAs generated using SPADE.

Towards a flexible framework to support a generalized extension of XACML for spatio-temporal RBAC model with reasoning ability

Purpose – The paper aims to propose a flexible framework to support X-STROWL model. Extensible access control markup language (XACML) is an international standard used for access control in distributed systems. However, XACML and its existing extensions are not sufficient to fulfill sophisticated security requirements (e.g. access control based on user’s roles, context-aware authorizations and the ability of reasoning). Remarkably, X-STROWL, a generalized extension of XACML for spatiotemporal role-based access control (RBAC) model with reasoning ability, is a comprehensive model that overcomes these shortcomings. It mainly focuses on the architecture design as well as the implementation and evaluation of proposed framework and the comparison with others. Design/methodology/approach – Based on the concept of X-STROWL model, the paper reviewed a large amount of open sources implementing XACML with defined criteria and chose the most suitable framework to be extended for the implementation. The paper also presented a case study used to evaluate the research result. Findings – Holistic enterprise-ready application security framework – architecture framework (HERAS-AF) is chosen as the most suitable framework to be extended to implement X-STROWL model. Extending HERAS-AF to support spatiotemporal aspect and other contextual conditions as well as the way to integrate security in the access request, together with ability of reasoning for hierarchical roles, are striking features that make the proposed framework able to meet more sophisticated security requirements in comparison with others. Research limitations/implications – Due to the research content, the performance of proposed framework is not the focused issue of this work. Originality/value – The proposed framework is a crucial contribution of our research to provide a holistic, extensible and intelligent authorization decision engine.

Specification, Validation, and Enforcement of a Generalized Spatio-Temporal Role-Based Access Control Model

With the advent of wireless and mobile devices, many new applications are being developed that make use of the spatio-temporal information of a user to provide better functionality. Such applications also necessitate sophisticated authorization models where access to a resource depends on the credentials of the user and also on the location and time of access. Consequently, researchers have extended the traditional access control models, such as role-based access control, to provide spatio-temporal access control. We improve upon these models by providing additional features that allow us to express constraints that were not possible until now. We express our model using the unified modeling language (UML) and the object constraint language that are the de facto specification languages used by the industry. Our model has numerous features that interact in subtle ways. To this end, we show how the UML-based specification environment tool can be used to analyze the spatio-temporal access control model of an application. We propose an architecture for enforcing our model and provide a protocol that demonstrates how access control can be granted and revoked in our approach. We also develop a prototype of this architecture to demonstrate the feasibility of our approach.

On the formalization and analysis of a spatio-temporal role-based access control model

With the growing use of wireless networks and mobile devices, we are moving towards an era of pervasive computing. Such environments will spawn new applications that use contextual information to provide enhanced services. Traditional access control models cannot protect such applications because the access requirements may be contingent upon the location of the user and the time of access. Consequently, we propose a new spatio-temporal role-based access control model that supports delegation for use in such applications. The model can be used by any application where the access is contingent not only on the role of the user, but also on the locations of the user and the object and the time of access. We describe how each entity in the role-based access control model is affected by time and location and propose constraints to express this. We also show how the formal semantics of our model can be expressed using graph-theoretic notation. The various features of our model give rise to numerous constraints that may interact with each other and result in conflicts. Thus, for any given application using our model, it is important to analyze the interaction of constraints to ensure that conflicts or security breaches do not occur. Manual analysis is tedious and error-prone. Towards this end, we show how the analysis can be automated using Coloured Petri Nets. Since automated analysis for large applications is time consuming, we propose an approach that reduces the analysis time.

A Formal Verification Framework for Security Policy Management in Mobile IP Based WLAN

The continuous advancement of wireless technologies especially for enterprise Wireless local area networks (LANs), demands well defined security mechanisms with appropriate architectural support to overcome various security loopholes. Implementing security policies on the basis of Role based Access Control (RBAC) models is an emerging field of research in WLAN security. However, verifying the correctness of the implemented policies over the distributed network devices with changes in topology, remains unexplored in the aforesaid domain. The enforcement of organizational security policies in WLANs require protection over the network resources from unauthorized access. Hence, it is required to ensure correct distribution of access control rules to the network access points conforming to the security policy. In WLAN security policy management, the standard IP based access control mechanisms are not sufficient to meet the organizational requirements due to its dynamic topology characteristics. In an enterprise network environments, the role-based access control (RBAC) mechanisms can be deployed to strengthen the security perimeter over the network resources. Further, there is a need to model the time and location dependent access constraints. In this paper, we propose a WLAN security management system supported by a formal spatio-temporal RBAC (STRBAC) model and a Boolean satisfiability (SAT) based verification framework. The concept of mobile IP has been used to ensure fixed layer 3 address mapping for the mobile hosts in a dynamic scenario. The system stems from logical partitioning of the WLAN topology into various security policy zones. It includes a Global Policy Server (GPS) that formalises the organisational access policies and determines the high level policy configurations for different policy zones; a Central Authentication & Role Server (CARS) which authenticates the users (or nodes) and the access points (AP) in various zones and also assigns appropriate roles to the users. Every host has to register their unique MAC address to a Central Authentication and Role Server(CARS). Each policy zone consists of an Wireless Policy Zone Controller (WPZCon) that coordinates with a dedicated Local Role Server (LRS) to extract the low level access configurations corresponding to the zone access router. We also propose a formal spatio-temporal RBAC (STRBAC) model to represent the global security policies formally and a SAT based verification framework to verify the access configurations

A WLAN security management framework based on formal spatio‐temporal RBAC model

AbstractIn today's organizations, the large scale deployment of wireless networks has opened up new directions in network security management. The organizational security policies aim at protecting the network resources from unauthorized accesses in the wireless local area networks (WLAN). In WLAN security policy management, the standard IP‐based access control mechanisms are not sufficient due to dynamic changes in network topology and access control states. The role‐based access control (RBAC) models may be appropriate to strengthen the security perimeter over the network resources. However, formalizing the dynamic binding of the access policies to the roles, depending on various control states, is a major challenge. In this paper, we propose a WLAN security policy management framework based on a formal spatio‐temporal RBAC (STRBAC) model. The present work primarily focuses on dynamic computation of security policies based on various control states, its formal representation using STRBAC model, and security property verification of the proposed STRBAC model. The proposed policy management framework logically partitions the WLAN topology into various security policy zones. The framework includes a Central Authentication & Role Server (CARS) which authenticates the users (nodes) and access points (AP) and also assigns appropriate roles to the users; a Global Policy Server (GPS) that dynamically computes the global security policy and policy configurations for different policy zones based on local user‐role and control state information; a distributed policy zone control architecture. Each policy zone consists of a Policy Zone Controller (WPZCon) which dynamically computes the low‐level access configurations. Finally, a SAT based verification procedure has been presented for verifying the security properties of the proposed STRBAC model. Copyright © 2010 John Wiley & Sons, Ltd.