Consistency maintenance for constraint in role-based access control model

Constraint is an important aspect of role based access control and is sometimes argued to be the principal motivation for role based access control (RBAC). But so far few authors have discussed consistency maintenance for constraint in RBAC model. Based on researches of constraints among roles and types of inconsistency among constraints, this paper introduces corresponding formal rules, rule based reasoning and corresponding methods to detect, avoid and resolve these inconsistencies. Finally, the paper introduces briefly the application of consistency maintenance in ZD PDM, an enterprise oriented product data management (PDM) system.

Centralized Role-Based Access Control for Federated Multi-Domain Environments

The secure interaction among multiple security domains is a major concern. In this paper, we highlight the issues of secure interoperability among multiple security domains operating under the widely accepted Role Based Access Control （RBAC） model. We propose a model called CRBAC that easily establishes a global policy for roles mapping among multiple security domains. Our model is based on an extension of the RBAC model. Also, multiple security domains were composed to one abstract security domain. Also roles in the multiple domains are translated to permissions of roles in the abstract security domain. These permissions keep theirs hierarchies. The roles in the abstract security domain implement roles mapping among the multiple security domains. Then, authorized users of any security domain can transparently access resources in the multiple domains.

A General Attribute and Rule Based Role-Based Access Control Model

Growing numbers of users and many access control policies which involve many different resource attributes in service-oriented environments bring various problems in protecting resource.This paper analyzes the relationships of resource attributes to user attributes in all policies, and propose a general attribute and rule based role-based access control(GAR-RBAC) model to meet the security needs. The model can dynamically assign users to roles via rules to meet the need of growing numbers of users. These rules use different attribute expression and permission as a part of authorization constraints, and are defined by analyzing relations of resource attributes to user attributes in many access policies that are defined by the enterprise. The model is a general access control model, and can support many access control policies, and also can be used to wider application for service. The paper also describes how to use the GAR-RBAC model in Web service environments.

The Research of Role Tree-Based Access Control Model

Towards the crossing and coupling permissions in tasks existed widely in many fields and considering the design of role view must rely on the activities of the tasks process,based on Role Based Accessing Control (RBAC) model,this paper put forward a Role Tree-Based Access Control (RTBAC) model. In addition,the model definition and its constraint formal description is also discussed in this paper. RTBAC model is able to realize the dynamic organizing,self-determination and convenience of the design of role view,and guarantee the least role permission when task separating in the mean time.

A Cache Considering Role-Based Access Control and Trust in Privilege Management Infrastructure

PMI （privilege management infrastructure） is used to perform access control to resource in an E-commerce or E-government system. With the ever-increasing need for secure transaction, the need for systems that offer a wide variety of QoS （quality-of-service） features is also growing. In order to improve the QoS of PMI system, a cache based on RBAC （Role-based Access control） and trust is proposed. Our system is realized based on Web service. How to design the cache based on RBAC and trust in the access control model is deseribed in detail. The algorithm to query role permission in cache and to add records in cache is dealt with. The policy to update cache is introduced also.

Role based access control design using Triadic concept analysis

Role based access control is one of the widely used access control models.There are investigations in the literature that use knowledge representation mechanisms such as formal concept analysis(FCA),description logics,and Ontology for representing access control mechanism.However,while using FCA,investigations reported in the literature so far work on the logic that transforms the three dimensional access control matrix into dyadic formal contexts.This transformation is mainly to derive the formal concepts,lattice structure and implications to represent role hierarchy and constraints of RBAC.In this work,we propose a methodology that models RBAC using triadic FCA without transforming the triadic access control matrix into dyadic formal contexts.Our discussion is on two lines of inquiry.We present how triadic FCA can provide a suitable representation of RBAC policy and we demonstrate how this representation follows role hierarchy and constraints of RBAC on sample healthcare network available in the literature.

An Efficient Role and Object Based Access Control Model Implemented in a PDM System

An effective and reliable access control is crucial to a PDM system.This article has discussed the commonly used access control models,analyzed their advantages and disadvantages,and proposed a new Role and Object based access control model that suits the particular needs of a PDM system.The new model has been implemented in a commercial PDM system,which has demonstrated enhanced flexibility and convenience.

Design and Implementation of File Access and Control System Based on Dynamic Web

A dynamic Web application, which can help the departments of enterprise to collaborate with each other conveniently, is proposed. Several popular design solutions are introduced at first. Then, dynamic Web system is chosen for developing the file access and control system. Finally, the paper gives the detailed process of the design and implementation of the system, which includes some key problems such as solutions of document management and system security. Additionally, the limitations of the system as well as the suggestions of further improvement are also explained.

Visualization Framework for Inter-Domain Access Control Policy Integration

The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- though a number of policy integration and sec- urity analysis mechanisms have been devel- oped, few focus on enabling the average ad- ministrator by providing an intuitive cognitive sense about the integrated policies, which considerably undermines the usability factor. In this paper we propose a visualization flame- work for inter-domain access control policy integration, which integrates Role Based Ac- cess Control （RBAC） policies on the basis of role-mapping and then visualizes the inte- grated result. The role mapping algorithm in the framework considers the hybrid role hier- archy. It can not only satisfy the security con- straints of non-cyclic inheritance and separa- tion of duty but also make visualization easier. The framework uses role-permission trees and semantic substrates to visualize the integrated policies. Through the interactive policy query visualization, the average administrator can gain an intuitive understanding of the policy integration result.

General Attribute Based RBAC Model for Web Services

Growing numbers of users and many access policies that involve many different resource attributes in service-oriented environments cause various problems in protecting resource. This paper analyzes the relationships of resource attributes to user attributes based on access policies for Web services, and proposes a general attribute based role-based access control（GARBAC） model. The model introduces the notions of single attribute expression, composite attribute expression, and composition permission, defines a set of elements and relations among its elements and makes a set of rules, assigns roles to user by inputing user＇s attributes values. The model is a general access control model, can support more granularity resource information and rich access control policies, also can be used to wider application for services. The paper also describes how to use the GARBAC model in Web services environments.

Design and Implementation of Linux Access Control Model

In this paper,the design and implementation of an access control model for Linux system are discussed in detail. The design is based on the RBAC model and combines with the inherent characteristics of the Linux system,and the support for the process and role transition is added.The core idea of the model is that the file is divided into different categories,and access authority of every category is distributed to several roles.Then,roles are assigned to users of the system,and the role of the user can be transited from one to another by running the executable file.

基于角色-功能的Web应用系统访问控制方法

分析现有基于角色的访问控制模型在Web应用系统中的不足,提出一种基于角色-功能模型的用户访问控制方法,并对其具体的实现进行讨论。以系统业务功能需求自然形成的Web页面组织结构和用户访问控制需求为基础,划分最底层菜单中页面实现的业务功能,以业务功能作为权限配置的基本单位,通过配置用户、角色、页面、菜单、功能之间的关系,控制用户对页面、页面中所包含的html元素及其操作等Web系统资源的访问。在山东交通学院科研管理系统中的实际应用结果表明,该方法在菜单及页面实现的业务功能上实施访问控制,可使Web系统用户访问控制较好地满足用户要求,有效降低Web系统开发的工作量。

基于型号装备-角色的IETM访问控制研究

针对交互式电子技术手册应用中的管理和安全保密需求,在分析传统访问控制模型的基础上,提出基于型号装备-角色的访问控制模型。该模型包括用户、型号装备、装备用户、角色、权限、操作访问控制规则、数据访问控制规则等,支持功能操作权限和数据权限分离,支持以型号装备结构为基础的细粒度数据访问控制以及以角色、装备用户为基础的功能操作访问控制定义和管理,给出了权限定义和权限计算方法。根据IETM的功能及数据访问控制需求,对交互式电子技术手册访问控制进行软件功能、控制流程及数据模型设计。采用J2EE及Web Service技术开发模块组件,实现交互式电子技术手册层级式、细粒度访问控制。

基于任务-操作的访问控制模型研究

访问控制是目前解决信息系统安全问题的主要技术。针对传统的基于任务-角色的访问控制策略在系统的安全性、通用性和实用性方面的不足,提出了一种新的基于任务-操作的访问控制模型(T-OBAC),该模型结合了基于任务和基于操作访问控制模型的共同优点,且角色描述更精确、安全性更好、应用更便捷、灵活。对它的基本原理、特点、实施步骤和实现方法等进行了深入研究,并通过一个实际系统开发的例子展示了模型应用的可行性和有效性。

分布式协作系统中基于任务-角色的访问控制研究

针对现有基于任务-角色的访问控制模型中存在的角色继承和工作流责权和表达问题进行了研究,提出了面向协作的角色继承关系和任务组合原语,以适应分布式协作系统的需求。面向协作的角色继承根据系统中角色之间的管理关系将角色对任务的操作权分为三类,不同操作权代表了不同的职责。任务组合原语根据工作流基本形式和任务统一管理的需求,定义了组合任务和任务组合关系,给出了语言的文法描述,并结合面向协作的角色继承规范了角色定义组合任务的能力范围。实验结果表明,提出的两个方案提高了访问控制系统的安全性,灵活性和扩展性。

基于T-RBAC的PMI模型

在工作流系统应用中,权限管理基础设施(PMI)模型存在数据冗余、动态适应性差的缺陷。针对该问题,提出一个基于任务-角色的访问控制的PMI模型。该模型通过增加任务规范角色证书与任务分配属性证书、PMI任务管理器与策略库,将访问权限与任务关联。应用结果证明该模型能够对访问控制进行动态、灵活的管理,实现基于角色、任务、角色和任务这3种访问控制,为企业信息安全管理提供保障。

CR^2DM:带约束的角色-角色代理模型

角色-角色代理作为授权代理的一种方式,简化了代理权限的管理,文中针对角色-角色代理的特点和可能的约束,提出了带约束的角色-角色代理模型CR2DM。该模型通过去除不符合角色-角色代理特点的成分,克服了其他模型过于复杂的缺点,并按照代理的继承性分为了三个子模型,其约束增强了模型安全性。

基于Sybase的MTS的安全管理

本文将 RBAC模型引入 MTS,给出了 RBAC的实现模块 ,然后描述了 MIS中如何进行 Sybase

基于Partial MAX-SAT求解法的RBAC授权查询方法

为保证系统的安全性并体现授权的有效性,结合部分最大可满足性问题(Partial MAX-SAT)的研究,提出一种基于Partial MAX-SAT求解法的授权查询方法。使用转换规则将静态授权逻辑和动态互斥角色约束转化为严格子句,采用子句更新算法将满足不同匹配的请求权限转化为松弛子句,并利用子句编码及递归算法寻求真值指派,以满足所有严格子句和尽可能多的松弛子句。实验结果表明,该方法搜索的角色组合能够保证系统的安全性,并满足最小权限分配要求,且最大、精确匹配请求的查询效率优于MAX-SAT求解法。