Sorting out role based access control

Kuijper, Wouter; Ermolaev, Victor

doi:10.1145/2613087.2613101

Cited by 14 publications

(7 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The alternative technique for expressing policy is by enumeration. Examples in this category include Policy Machine (PM) [5] and 2-sorted-RBAC [13].…”

Section: Abac Styles and Scopesmentioning

confidence: 99%

“…2-sorted-RBAC [13], on the other hand is an example to use enumerated policy in the context of RBAC [18]. In 2sorted-RBAC, roles are split into proper roles containing group of users and demarcations containing group of permissions.…”

Section: Enumerated Policymentioning

confidence: 99%

“…Another method for specifying attribute-based policies is by enumeration. Policy Machine [5] and 2-sorted-RBAC [13] fall into this category. Enumerated policies can also be very expressive.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Label-Based Access Control

Biswas

Sandhu²,

Krishnan

2016

Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control

View full text Add to dashboard Cite

There are two major techniques for specifying authorization policies in Attribute Based Access Control (ABAC) models. The more conventional approach is to define policies by using logical formulas involving attribute values. Examples in this category include ABACα, HGABAC and XACML. The alternate technique for expressing policies is by enumeration. Policy Machine (PM) and 2-sorted-RBAC fall into the later category. In this paper, we present an ABAC model named LaBAC (Label-Based Access Control) which adopts the enumerated style for expressing authorization policies. LaBAC can be viewed as a particularly simple instance of the Policy Machine. LaBAC uses one user attribute (uLabel) and one object attribute (oLabel). An authorization policy in LaBAC for an action is an enumeration using these two attributes. Thus, LaBAC can be considered as a bare minimum ABAC model. We show equivalence of LaBAC and 2-sorted-RBAC with respect to theoretical expressive power. Furthermore, we show how to configure the traditional RBAC (Role-Based Access Control) and LBAC (Lattice-Based Access Control) models in LaBAC to illustrate its expressiveness.

show abstract

“…The alternative technique for expressing policy is by enumeration. Examples in this category include Policy Machine (PM) [5] and 2-sorted-RBAC [13].…”

Section: Abac Styles and Scopesmentioning

confidence: 99%

Section: Enumerated Policymentioning

confidence: 99%

See 1 more Smart Citation

Label-Based Access Control

Biswas

Sandhu²,

Krishnan

2016

Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control

View full text Add to dashboard Cite

show abstract

“…Generally, any ABAC model can be expressed based on logical-formula authorization policy (LAP) or enumerated authorization policy (EAP) [21]. However, most of the proposed ABAC models [3, 4, 7-9, 24, 25] in literature are based on LAP, with very few EAP-ABAC models [5,18,21,26].…”

Section: Introductionmentioning

confidence: 99%

ABAC with Group Attributes and Attribute Hierarchies Utilizing the Policy Machine

Bhatt

Patwa

Sandhu

2017

Proceedings of the 2nd ACM Workshop on Attribute-Based Access Control

View full text Add to dashboard Cite

Attribute-Based Access Control (ABAC) has received significant attention in recent years, although the concept has been around for over two decades now. Many ABAC models, with different variations, have been proposed and formalized. Besides basic ABAC models, there are models designed with additional capabilities such as group attributes, group and attribute hierarchies and so on. Hierarchical relationship among groups and attributes enhances access control flexibility and facilitates attribute management and administration. However, implementation and demonstration of ABAC models in real-world applications is still lacking. In this paper, we present a restricted HGABAC (rHGABAC) model with user and object groups and group hierarchy. We then introduce attribute hierarchies in this model. We also present an authorization architecture for implementing rHGABAC utilizing the NIST Policy Machine (PM). PM allows to define attribute-based access control policies, however, the attributes in PM are different in nature than attributes in typical ABAC models as name-value pairs. We identify a policy configuration mechanism for our proposed model employing PM capabilities, and demonstrate use cases and their configuration and implementation in PM using our authorization architecture.

show abstract

“…The dynamic and decentralized nature of OSNs, where ReBAC is mainly deployed so far, suggests a unified but decentralized solution to enforce administration in a scalable and efficient way. Following the prior success of using role-based access control (RBAC) to manage RBAC [10,19,21,26,31,35], a natural direction for ReBAC adminstration would be using ReBAC itself to manage Re-BAC.…”

Section: Introductionmentioning

confidence: 99%

Extended ReBAC Administrative Models with Cascading Revocation and Provenance Support

Cheng

Bijon²,

Sandhu

2016

Proceedings of the 21st ACM on Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

Relationship-based access control (ReBAC) has been widely studied and applied in the domain of online social networks, and has since been extended to domains beyond social. Using ReBAC itself to manage ReBAC also becomes a natural research frontier, where we have two ReBAC administrative models proposed recently by Rizvi et al. [30] and Stoller [33]. In this paper, we extend these two ReBAC administrative models in order to apply ReBAC beyond online social networks, particularly where edges can have dependencies with each other and authorization for certain administrative operations requires provenance information. Basically, our policy specifications adopt the concepts of enabling precondition and applicability preconditions from Rizvi et al. [30]. Then, we address several issues that need to be considered in order to properly execute operation effects, such as cascading revocation and integrity constraints on the relationship graph. With these extended features, we show that our administrative models can provide the administration capability of the MT-RBAC model originally designed for multi-tenant collaborative cloud systems [34].

show abstract

Sorting out role based access control

Cited by 14 publications

References 19 publications

Label-Based Access Control

Label-Based Access Control

ABAC with Group Attributes and Attribute Hierarchies Utilizing the Policy Machine

Extended ReBAC Administrative Models with Cascading Revocation and Provenance Support

Contact Info

Product

Resources

About