A secure, constraint-aware role-based access control interoperation framework

Abstract

Abstract-With the growing needs for and the benefits of sharing resources and information among different organizations, an interoperation framework that automatically integrates policies to facilitate such cross-domain sharing in a secure way is becoming increasingly important. To avoid security breaches, such policies must enforce the policy constraints of the individual domains. Such constraints may include temporal constraints that limit the times when the users can access the resources, and separation of duty (SoD) constraints. Existing interoperation solutions do not address such cross-domain temporal access control and SoDs requirements. In this paper, we propose a role-based framework to facilitate secure interoperation among multiple domains by ensuring the enforcement of temporal and SoD constraints of individual domains. To support interoperation, we do not modify the internal policies, as most of the current approaches do. We present experimental results to demonstrate our proposed framework is effective and easily realizable.

Extending OpenStack Access Control with Domain Trust

“…On the other hand, the user owner needs to monitor or constrain the roles assigned to its users in other domains in order to prevent violations of security in multi-domain interoperation [7,18]. In this setting, the collaborating domains should both have control over the cross-domain access instead of only one of them.…”

Multi‐tenancy authorization models for collaborative cloud services

“…Also, the conflict duties may be associated with different cloud services. In this case, the constraint policy composition process can become very complicated . Thus, the CSP should be responsible to identify potential conflict roles.…”

“…Addressing multi‐domain secure interoperation, the role mapping approaches allow external users in trusted domains to acquire privileges in a local domain through role hierarchy relations. These approaches focus on extending RBAC models and enabling interoperation by mapping roles between domains.…”

“…It helps maintain autonomy for inter‐domain role accesses. Baracaldo et al , present a policy enforcement framework to enforce temporal and SoD constraints for multi‐domain interoperation. Moreover, Shehab et al , introduce a distributed secure interoperability framework to link multiple domains.…”

Representation of multiple domain role based access control using FCA

“…There is an integer programming based approach to resolve the conflicts in the principles of secure inter operation of RBAC models introduced by Shafiq et al [17]. Nathalie et al [18] has proposed a role based framework to enable secure inter operation among multiple domains with temporal and separation of duty constraints. A formal security policy model for multi-domain mobile network has been proposed by Unal et al [4] deals with location and mobility constraints , role hierarchy mapping , inter domain access right , inter domain services and separation of duty.…”