A formal model for hierarchical policy contexts

Role-based access control (RBAC) models specify a policy interface for security administration, but do not provide guidelines for how large organisations should manage their roles. Parameterised RBAC systems are even more expressive; however, this adds to the risk of dangerous mistakes during policy specification. In this paper we define a formal model for hierarchical policy contexts: an RBAC meta-policy approach for subdividing the administration of large-scale security environments and for enforcing information flow restrictions over policies.

[1]  David M. Eyers,et al.  Policy contexts: controlling information flow in parameterised RBAC , 2003, Proceedings POLICY 2003. IEEE 4th International Workshop on Policies for Distributed Systems and Networks.

[2]  Andreas Schaad,et al.  Observations on the role life-cycle in the context of enterprise security management , 2002, SACMAT '02.

[3]  D. Elliott Bell,et al.  Secure Computer System: Unified Exposition and Multics Interpretation , 1976 .

[4]  Ravi S. Sandhu,et al.  The NIST model for role-based access control: towards a unified standard , 2000, RBAC '00.

[5]  David W. Chadwick,et al.  The PERMIS X.509 role based privilege management infrastructure , 2003, Future Gener. Comput. Syst..

[6]  Emil C. Lupu,et al.  The Ponder Policy Specification Language , 2001, POLICY.

[7]  D B Baker,et al.  PCASSO: a model for safe use of the Internet in healthcare. , 2000, Journal of AHIMA.

[8]  Jeremy L. Jacob,et al.  The role-based access control system of a European bank: a case study and discussion , 2001, SACMAT '01.

[9]  Valérie Issarny,et al.  Dealing with Multi-policy Security in Large Open Distributed Systems , 1998, ESORICS.

[10]  Sylvia L. Osborn.  Information flow analysis of an RBAC system , 2002, SACMAT '02.

[11]  Jean Bacon,et al.  A model of OASIS role-based access control and its support for active security , 2002, ACM Trans. Inf. Syst. Secur..

[12]  András Belokosztolszki,et al.  Role-based access control policy administration , 2004 .

[13]  Pietro Iglio,et al.  A formal model for role-based access control with constraints , 1996, Proceedings 9th IEEE Computer Security Foundations Workshop.

[14]  Dorothy E. Denning,et al.  A lattice model of secure information flow , 1976, CACM.

[15]  David M. Eyers,et al.  Shielding RBAC Infrastructures from Cyberterrorism , 2002, DBSec.

[16]  Sylvia L. Osborn,et al.  The role graph model and conflict of interest , 1999, TSEC.