2000 Proceeding- Chairmen:
- Klaus Rebensburg,
- Charles Youman,
- Vijay Atluri
No abstract available.
Injecting RBAC to secure a Web-based workflow system
Web-based workflow systems have recently received much attention because they can support dynamic business processes over heterogeneous computing systems. Most existing web-based workflow systems, however, provide minimal security services such as ...
Application of XML tools for enterprise-wide RBAC implementation tasks
The use of Extensible Markup Language (XML) and its associated APIs, for information modeling and information interchange applications is being actively explored by the reseach community. In this paper we develop an XML Document Type Definition (DTD) ...
TRBAC: a temporal role-based access control model
Role-based access control (RBAC) models are receiving increasing attention as a generalized approach to access control. Roles can be active at certain time periods and non active at others; moreover, there can be activation dependencies among roles. To ...
Modeling users in role-based access control
The essential properties of a simple model for users, groups and group hierarchies for role-based access control, embodied in a group graph, are presented. The interaction between the group graph and the role graph model of Nyanchama and Osborn is ...
The NIST model for role-based access control: towards a unified standard
This paper describes a unified model for role-based access control (RBAC). RBAC is a proven technology for large-scale authorization. However, lack of a standard model results in uncertainty and confusion about its utility and meaning. The NIST model ...
Rebuttal to the NIST RBAC model proposal
In this abstract, we rebut the proposed RBAC unified reference model as defined by Sandhu, Ferriaolo, and Kuhn [4]. As a unified reference model, this proposal simply re-enforces some of the concepts that are fundamental to RBAC (i.e., roles, users, and ...
A model of accountability, confidentiality and override for healthcare and other applications
A UML model of Authorisation is described, which was developed for an Electronic Medical Records application in collaboration with the UK NHS Information Authority. The model is an enhancement of the UK Healthcare Model (HcM), in that it provides extra ...
Enabling technologies for role based online decision engines
The implementation of an RBAC system at the TUB led us towards a specific meaning of role-based access control, where decisions regarding user permissions are based on online evaluations of a distributed RBAC model, we call this approach role-based ...
Three for one: role-based access-control management in rapidly changing heterogeneous environments
We describe a maintenance tool for role-based access-control (RBAC0, RBAC1 and RBAC2 [1]), implemented in a Swiss bank. Concept and implementation of the system is as far as possible independent of operating system and vendors. The tool supports the ...
Integrated constraints and inheritance in DTAC
Inheritance and constraints are two common techniques for safely managing the complexity of large access control configurations. Inheritance is used to help factor the model, while constraints are used to help ensure that the complexity will not result ...
Process-oriented approach for role-finding to implement role-based security administration in a large industrial organization
In this paper we describe the work in progress with a process-oriented approach for role-finding to implement Role-Based Security Administration. Our results stem from using a recently proposed role model and procedural model at Siemens AG ICN, a large ...
Engineering authority and trust in cyberspace: the OM-AM and RBAC way
Information systems of the future will be large-scale, highly decentralized, pervasive, span organizational boundaries and evolve rapidly. Effective security in this cyberspace will require engineering authority and trust retationships across ...
Index Terms
- Proceedings of the fifth ACM workshop on Role-based access control
Recommendations
Role-Based Access Control Models
Since the 1970s, computer systems have featured multiple applications and served multiple users, leading to heightened awareness of data security issues. System administrators and software developers focused on different kinds of access control to ...
Delegation in role-based access control
User delegation is a mechanism for assigning access rights available to one user to another user. A delegation can either be a grant or transfer operation. Existing work on delegation in the context of role-based access control models has extensively ...
Configuring role-based access control to enforce mandatory and discretionary access control policies
Access control models have traditionally included mandatory access control (or lattice-based access control) and discretionary access control. Subsequently, role-based access control has been introduced, along with claims that its mechanisms are general ...