An object-oriented organizational model to support dynamic role-based access control in electronic commerce applications

Abstract

Role-based access control (RBAC) provides flexibility to security management over the traditional approach of using user and group identifiers. In RBAC, access privileges are given to roles rather than to individual users. Users acquire the corresponding permissions when playing different roles. Roles can be defined simply as a label, but such an approach lacks the support to allow users to automatically change roles under different contexts; this static method also adds administrative overheads in role assignment. In electronic commerce and other cooperative computing environments, access to shared resources has to be controlled in the context of the entire business process; it is therefore necessary to model dynamic roles as a function of resource attributes and contextual information.In this paper, an object-oriented organizational model, OMM, is presented as an underlying model to support dynamic role definition and role resolution in RBAC. The paper describes the OMM reference model and shows how it can be applied flexibly to capture the different classes of resources within a corporation, and to maintain the complex and dynamic roles and relationships between the resource objects. Administrative tools use the role model in OMM to define security policies for role definition and role assignment. At runtime, the resource manager queries the OMM system to resolve roles in order to authorize any access attempts. Similarly, cooperative computing software uses OMM to support task assignment and access control to business processes. Contrary to traditional approaches, OMM separates the organization model from the application model; thus it allows independent and flexible role modeling to reflect realistically a dynamic authorization subsystem in a rapidly changing business world.

Information systems resources and information security

“…The identification and authority component includes verification and authentication techniques associated with verifying users' identities and access rights (Budiarto and Masahiko 2002;Joshi et al 2001;Priem and Butler 2001). The data access control component consists of access control tools and equipment to control information access (Cheng 1999;Ferraiolo et al 2001;Gunter 2000;Zhang and Yang 2003), while the data encryption and decryption component consists of technology that functions to protect sensitive information from unauthorized access (Joshi et al 2001;Twitchell 2004;Velissarios and Santarossa 1999). The data storage and backup component includes backup devices that keep information accessible during system failures or data impairment (Twitchell 2004;Schultz et al 2001;Weill et al 2002).…”

Integrate Policy based Management and Process based Management -- A New Approach for Workflow Management System

“…In [7] an object-oriented organizational model, OMM, is presented as an underlying model to support dynamic role definition. In [8] an organization and resource model is presented.…”

Organization based access control

“…More precisely, if a given permission is granted to a given role, then all users that play this role will inherit the given permission. Therefore, it is not possible to specify that a physician is permitted to have a direct access to the patient records, unless he/she is one of the physician's patient [12,13]. Moreover, as mentioned in the previous section, another limit of the RBAC model is that it only enables the administrator to specify permissions.…”