Browse > Article
http://dx.doi.org/10.9708/jksci.2010.15.12.217

A System Architecture Design for Web-Based Application Systems using Role-Based Access Control  

Lee, Ho (한국재활복지대학 컴퓨터정보보안과)
Publication Information
Journal of the Korea Society of Computer and Information / v.15, no.12, 2010 , pp. 217-225 More about this Journal
Abstract
Among web-based systems being widely used now, there are so many systems which are still using an user-level access control method. By successfully applying role-based access control(RBAC) to web-based application systems, we can expect to have an effective means with reinforced security for Internet-based systems. In order to apply RBAC to web-based application systems, we should come up with a system architecture for it. I proposed a system architecture which is needed to apply RBAC to web-based application systems. The proposed system architecture is largely composed of system composition and system functioning. For details, firstly, a certificate used by RBAC is specified. Secondly, a system architecture using a user-pull method is proposed and overall system components are mentioned with a role server being centered. Then, I showed how the system architecture can work to carry out RBAC on web-based application systems. Lastly, the analyses on the proposed system architecture are described for the purpose of proving its feasibility.
Keywords
RBAC(Role-Based Access Control); RBAC; Access Control;
Citations & Related Records
Times Cited By KSCI : 2  (Citation Analysis)
연도 인용수 순위
1 Elisa Bertino, Silvana Castano, Elena Ferrari, "On Specifying Policies for Web Documents with an XML-based Language", Proc. of ACM on RBAC, pp. 57-65, 2001.
2 Microsoft, "Internet Information Server", IIS Help File with Windows 2000 Advanced Server, pp. 1-8, 2000.
3 Serban I. Gavrila, John F. Barkley, "Formal Specification for RBAC User/Role and Role/Role Relationship Management", Proc. of ACM 3rd Workshop on RBAC, pp. 81-90, 1998.
4 이호, 정진욱, "통합 접근 제어를 위한 시뮬레이션 모델 설계", 한국컴퓨터정보학회 논문지, 제 9권 제 4호, 5쪽, 2004년 12월.   과학기술학회마을
5 Joon S. Park, "Secure Attribute Services on the Web", Ph.D Thesis, George Mason University, Aug. 1999.
6 이호, 정진욱, "안전한 인터넷 사용을 위한 접근 제어 메커니즘 설계", 한국컴퓨터정보학회 논문지, 제 5권 제 3호, 84-90쪽, 2000년 7월.
7 이호, "웹기반 응용을 위한 직무기반접근 제어 모델의 설계", 한국사이버테러정보전학회 정보보증논문지 제 2권 제 2호, 59-66쪽, 2002년 12월.
8 Joon S. Park, Ravi Sandhu, "Decentralized User-Role Assignment for Web-based Intranets", Proc. of ACM on RBAC, pp. 1-12, 1998.
9 Joon S. Park, RaviSandhu, "RBAC on the Web by Smart Certificates", Proc. of ACM on RBAC, pp. 1-9, 1999.
10 Gail-Joon Ahn, Ravi Sandhu, Myong Kang, Joon Park, "Injecting RBAC to Secure a Web-based Workflow System", Proc. of ACM on RBAC, pp. 1-10, 2000.
11 Andreas Schaad, Jonathan Moffett, Jeremy Jacob, "The RBAC of a European Bank", Proc. of ACM on RBAC, pp. 3-9, 2001.
12 A. Schaad, "Detecting Conflicts in a Role-Based Delegation Model", Proc. of the 17th Annual Conference on Computer Security Applications, pp. 117-127, Dec. 10-14, 2001.
13 Bandmann O, Dam M, Firozabadi B S, "Constrained Delegation", Proc. of IEEE Symposium on Security and Privacy, pp. 131-140, 2002.
14 Ravi S. Sandhu, Edward J. Coyne, "Role-Based Access Control Models", IEEE Computer, pp. 38-47, Feb. 1996.