Towards Unifying RBAC with Information Flow Control

Role-based Access Control (RBAC) is one of the most widely implemented access control models. In today's complex computing systems, one of the increasingly sought-after features for reliable security is information flow control. Although RBAC is a policy-neutral and generic model, its implementations generally do not provide information flow control. In this paper, we present two approaches to address this issue. In the first method, we describe how a lattice model can be captured using an RBAC configuration. In the second method, we analyze the information flows in a given RBAC policy using a decentralized lattice model called Readers-Writers Flow Model. This method identifies the indirect information flows in the policy and helps in creating flow-secure RBAC policies. We discuss the scope and limitations of these methods in detail and also present a brief case study. Finally, we investigate the use of flow-secure RBAC policies in creating flow-secure Attribute-based Access Control (ABAC) policies.

[1]  Ehud Gudes,et al.  Resolving Information Flow Conflicts in RBAC Systems , 2006, DBSec.

[2]  Dorothy E. Denning,et al.  A lattice model of secure information flow , 1976, CACM.

[3]  Sylvia L. Osborn,et al.  Modeling Mandatory Access Control in Role-Based Security Systems , 1995, DBSec.

[4]  Ravi S. Sandhu.  Role Hierarchies and Constraints for Lattice-Based Access Controls , 1996, ESORICS.

[5]  R. K. Shyamasundar,et al.  Consistency analysis and flow secure enforcement of SELinux policies , 2020, Comput. Secur..

[6]  Sylvia L. Osborn.  Information flow analysis of an RBAC system , 2002, SACMAT '02.

[7]  Matt Bishop,et al.  Computer Security: Art and Science , 2002 .

[8]  Ravi S. Sandhu,et al.  Rationale for the RBAC96 family of access control models , 1996, RBAC '95.

[9]  David F. Ferraiolo,et al.  Guide to Attribute Based Access Control (ABAC) Definition and Considerations , 2014 .

[10]  D. Richard Kuhn,et al.  Adding Attributes to Role-Based Access Control , 2010, Computer.

[11]  Sylvia L. Osborn,et al.  The role graph model and conflict of interest , 1999, TSEC.

[12]  Crispin Cowan,et al.  Linux security modules: general security support for the linux kernel , 2002, Foundations of Intrusion Tolerant Systems, 2003 [Organically Assured and Survivable Information Systems].

[13]  David Sands,et al.  Paralocks: role-based information flow control and beyond , 2010, POPL '10.

[14]  Ravi S. Sandhu,et al.  The NIST model for role-based access control: towards a unified standard , 2000, RBAC '00.

[15]  K. J. Bma.  Integrity considerations for secure computer systems , 1977 .

[16]  Kyle Pullicino,et al.  Jif: Language-based Information-flow Security in Java , 2014, ArXiv.

[17]  Ravi S. Sandhu,et al.  The authorization leap from rights to attributes: maturation or chaos? , 2012, SACMAT '12.

[18]  Ram Krishnan,et al.  On the Feasibility of RBAC to ABAC Policy Mining: A Formal Analysis , 2019, SKM.

[19]  R. K. Shyamasundar,et al.  A Complete Generative Label Model for Lattice-Based Access Control Models , 2017, SEFM.

[20]  Scott D. Stoller,et al.  Mining Attribute-Based Access Control Policies , 2013, IEEE Transactions on Dependable and Secure Computing.

[21]  Dominique Devriese,et al.  FlowFox: a web browser with flexible and precise information flow control , 2012, CCS '12.

[22]  Michael J. Nash,et al.  The Chinese Wall security policy , 1989, Proceedings. 1989 IEEE Symposium on Security and Privacy.

[23]  R. K. Shyamasundar,et al.  FlowConSEAL: Automatic Flow Consistency Analysis of SEAndroid and SELinux Policies , 2018, DBSec.

[24]  Winfried E. Kühnhauser,et al.  WorSE: A Workbench for Model-based Security Engineering , 2014, Comput. Secur..

[25]  L.,et al.  SECURE COMPUTER SYSTEMS : MATHEMATICAL FOUNDATIONS , 2022 .

[26]  Mikhail I. Gofman,et al.  RBAC-PAT: A Policy Analysis Tool for Role Based Access Control , 2009, TACAS.

[27]  Ravi S. Sandhu,et al.  Configuring role-based access control to enforce mandatory and discretionary access control policies , 2000, TSEC.