Permission-Based Separation of Duty in Dynamic Role-Based Access Control Model

Abstract

A major development in the field of access control is the dominant role-based access control (RBAC) scheme. The fascination of RBAC lies in its enhanced security along with the concept of roles. In addition, attribute-based access control (ABAC) is added to the access control models, which is famous for its dynamic behavior. Separation of duty (SOD) is used for enforcing least privilege concept in RBAC and ABAC. Moreover, SOD is a powerful tool that is used to protect an organization from internal security attacks and threats. Different problems have been found in the implementation of SOD at the role level. This paper discusses that the implementation of SOD on the level of roles is not a good option. Therefore, this paper proposes a hybrid access control model to implement SOD on the basis of permissions. The first part of the proposed model is based on the addition of attributes with dynamic characteristics in the RBAC model, whereas the second part of the model implements the permission-based SOD in dynamic RBAC model. Moreover, in comparison with previous models, performance and feature analysis are performed to show the strength of dynamic RBAC model. This model improves the performance of the RBAC model in terms of time, dynamicity, and automatic permissions and roles assignment. At the same time, this model also reduces the administrator’s load and provides a flexible, dynamic, and secure access control model.

A Hybrid Access Control Model With Dynamic COI for Secure Localization of Satellite and IoT-Based Vehicles

“…According to this work, the administrator starts creating attributed objects and actions with COI. There is no need to create the permissions one by one as well as by creating different containers, as the previous models do [18], [22], [56]. The system automatically creates the permissions by merging newly created actions with objects and creates all the possible permissions itself.…”

“…Even some of the authors proposed to create multiple permissions by creating different containers. In our opinion, those solutions are increasing the administrative load instead of decreasing [22], [56]. But the proposed model just initiates the permission creation process and the system will create all the possible permissions at once.…”

An Improved Genetic Algorithm for Safety and Availability Checking in Cyber-Physical Systems

“…ABAC first establishes the attribute set and describes the access control policy, and then responds to the access control request and updates the access control policy during execution [12]. RBAC guarantees flexible control and management of objects through a dual authority mapping mechanism, and provides inter-domain role mapping and constraint verification methods in cross-entity access control of CPS [15], [16]. When constructing attribute set and permission mapping, usually use role engineering or attribute engineering topdown or bottom-up method to mine roles or attributes to further authorize users.…”

“…The separation of duty (SOD) policies is a typical policy used to ensure safety [19]. It prevent a set of users less than a certain threshold from being fully authorized to perform sensitive tasks [15], [16], [20]. Excessive pursuit of system safety may lead to unavailability of the system.…”

Big data security access control algorithm based on memory index acceleration in WSNs

“…The access control models can be divided into 5 categories: the discretionary access control (DAC) [5], the mandatory access control (MAC) [6], the role-based access control (RBAC) [7][8][9], the attribute-based access control (ABAC) [10], the policy-based access control (PBAC) [11,12]. Various data security algorithms are used to improve the security of the access control model.…”