Browse > Article
http://dx.doi.org/10.13089/JKIISC.2005.15.3.13

A Role-Based Access Control Model ensuring Confidentiality and Integrity  

Byun Chang-Woo (Sogang University)
Park Seog (Sogang University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.15, no.3, 2005 , pp. 13-29 More about this Journal
Abstract
An important characteristic of role-based access control model(RBAC) is that by itself it is policy neutral. This means RBAC articulates security policy without embodying particular security policy. Because of this reason, there are several researches to configure RBAC to enforce traditional mandatory access control(MAC) policy and discretionary access control(DAC) policy. Specifically, to simulate MAC using RBAC several researches configure a few RBAC components(user, role, role-hierarchy, user-role assignment and session) for keeping no-read-up rule and no-write-down rule ensuring one-direction information flow from low security level to high security level. We show these researches does not ensure confidentiality. In addition, we show the fact that these researches overlook violation of integrity due to some constraints of keeping confidentiality. In this paper we propose a RBAC model satisfying both confidentiality and integrity. We reexamine a few RBAC components and constructs additional constraints.
Keywords
role-based access control; mandatory access control; confidentiality; integrity;
Citations & Related Records
연도 인용수 순위
  • Reference
1 R. Sandhu, 'Role Activation Hierarchies', Proc. of 3rd ACM Workshop on Role- Based Access Control, 1998.10
2 David D. Clark and David R. Wilson, 'A Comparison of Commercial and Military Computer Security Policies', Proc. of the 1987 IEEE Symposium on Security and Privacy, 1987. pp.184-194
3 R. Sandhu, E. Coyne, H. Feinstein, and C. Younman, 'Role-Based Access Control Models', IEEE Computer Magazine Vol. 29, 1996.2
4 C. Ramaswamy and R. Sandhu, 'Role- Based Access Control Features in Commercial Database Management Systems', NISSC, 1998
5 D. E. Bell and L. J. LaPadula, 'Secure Computer Systems: mathematical Foundations and Model', Mitre Corp. Report No. M74-244, Bedford, Mass., 1975
6 S. Osborn, R. Sandhu and Q. Munawer, 'Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies' , ACM Transactions on Information and Systems Security, vol.3, no. 2, 2000
7 K. J. Biba, 'Integrity Considerations for Secure Computer Systems', Mirte Corp. Report TR-3153, Bedford, Mass, 1977
8 U.S. Department of Defense, Department of Defense Trusted Computer System Evaluation Criteria, DOD 5200.28-STD, National Computer Security Center, 1985
9 S. Osborn, 'Mandatory Access Control and Role-Based Access Control Revisited', Proc. of RBAC97, ACM, 1997
10 R. Sandhu, 'Role-Hierarchies and Constraints for Lattice-Based Access Controls', Proc. Fourth European Symposium on Research in Computer Security, Rome, Italy, Sep. 25- 27, 1996