{"title":"Role templates for content-based access control","authors":"Luigi Giuri, Pietro Iglio","doi":"10.1145/266741.266773","DOIUrl":"https://doi.org/10.1145/266741.266773","url":null,"abstract":"This paper proposes a role-based access control model that provides special mechanisms for the definition of content-based access control policies. More precisely, this model defines the concept of parameterized privilege to restrict the access on subsets of objects, and the concept of role template to support composition and encapsulation of parameterized privileges.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130154324","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"hyperDRIVE: leveraging LDAP to implement RBAC on the Web","authors":"L. Bartz","doi":"10.1145/266741.266759","DOIUrl":"https://doi.org/10.1145/266741.266759","url":null,"abstract":"Introduction The widespread transition to Web-based and associated internet technology computing platforms has provided fertile ground for the germination and cultivation of authorization strategies. The degrees of sophistication and effectiveness of the many currently available approaches vary widely. None has yet proven itself clearly superior. None yet provides for the economical scalability necessary to support integrated internet or intranet computing environments which are composed of many applications, hosted by many servers.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115085751","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Rule based database access control—a practical approach","authors":"T. Didriksen","doi":"10.1145/266741.266772","DOIUrl":"https://doi.org/10.1145/266741.266772","url":null,"abstract":"This paper describes a scheme to partition a database into fragments, and to associate access constraints in the form of declarative rules with these fragments. We present SQL extensions to specify data fragmentation and access constraints. nom this, a compiler generates triggers which verify that users do not violate the constraints. Major practical requirements for the implementation of our access control scheme are that existing application code must be left unchanged, and that an efficient implementation based on standard database management systems is possible. Our strategy has been applied successfully at Telenor -a Norwegian telephony service provider.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"289 ","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120873192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"RBAC emulation on trusted DG/UX","authors":"W. Meyers","doi":"10.1145/266741.266754","DOIUrl":"https://doi.org/10.1145/266741.266754","url":null,"abstract":"One goal of Role-Based Access Control (RBAC) research is to identify generally applicable mechanisms that are sufficiently flexible to support RBAC behavior in diverse applications. This paper discusses three candidate mechanisms that are available in DG/UX@ B2 Security Option, a high security commercial off-the-shelfoperating system. Quite a bit of RBAC semantics can be achieved by simply setting the system’s site-configurable policy parameters. Additional RBAC features, such as dynamic role management, can be realized with modest amounts of site-written software. To improve manageability, an RRAC presentation layer can also be added to the site-extensible administration interface. The effort required to retain the high security assurances of the underlying operating system, using these mechanisms, ranges from none to reasonable.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"133 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123590457","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Determining role rights from use cases","authors":"Eduardo B. Fernández, J. Hawkins","doi":"10.1145/266741.266767","DOIUrl":"https://doi.org/10.1145/266741.266767","url":null,"abstract":"We propose a simple and complete method to determine the needed rights for roles in a system. We make use of the concept of use cases, commonly used to determine requirements in object-oriented system development. We extend use cases with rights specifications and we determine all of a role’s rights from the collection of all use cases for the system. This method is in strict accordance with the least privilege principle.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132585507","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
R. Sandhu, Venkata Bhamidipati, E. Coyne, Srinivas Ganta, C. E. Youman
{"title":"The ARBAC97 model for role-based administration of roles: preliminary description and outline","authors":"R. Sandhu, Venkata Bhamidipati, E. Coyne, Srinivas Ganta, C. E. Youman","doi":"10.1145/266741.266752","DOIUrl":"https://doi.org/10.1145/266741.266752","url":null,"abstract":"In role-based access control (RBAC) permissions are associated with roles, and users are made members of roles thereby acquiring the roles’ permissions. The motivation behind RBAC is to simplify administration. An appealing possibility is to use RBAC itself to manage RBAC, to further provide administrative convenience, especially in decentralizing administrative authority, responsibility and chores. This paper describes the motivation, intuition and outline of a new model for RBAC administration called ARBAC97 (administrative RBAC ‘97). ARBAC97 has three components: URA97 (user-role assignment ‘97), PRA97 (permissionrole assignment ‘97) and RRA97 (role-role assignment ‘97). URA97 was recently defined by Sandhu and Bhamidipati [SB97]. ARBAC97 incorporates URA97, builds upon it to define PRA97 and some components of RRA97, and introduces additional concepts in developing RRA97. *This work is partially supported by the National Science Fmmdation at the Laboratory for Information Security Technology at George Mason University and the National Institute of Standards and Technology at SETA Corporation. All correspondence should be addressed to Ravi Sandhu, ISSE Department, Mail Stop 4A4, George Mason University, Fairfax, VA 22030, sandhu@isse.gmu.edu, wvw.list.gmu.edu.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128547431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Support for discretionary role based access control in ACL-oriented operating systems","authors":"C. Friberg, A. Held","doi":"10.1145/266741.266763","DOIUrl":"https://doi.org/10.1145/266741.266763","url":null,"abstract":"‘Ilie iml~lemrlil.at,ioli of discr&ionary role-lmscd it<‘cess cY)ntrol nic~c&anisnis in standard operat,ing syst)ems like [inix suffers from t#he inahilit,y of t,hta systclii t,o allow a user t,o r&rict, his processes’ cont,rol over his own ohjtct~s. Hy cxploit,ing t,he user’s a~t‘ss right,s tro,jan horses, possibly hidden in down1oadetl (~x(~cutabI(~ corit,enl,, (‘an u~itlcrrriine t tic access c-0111.rol policy l,o perform t.heir malicious t,asks. This paper present,s an approach t.o restrict the rights of procPssr,s l)y switching bct,wccn hicrarcliically organized user drfiued subdomains with simple system calls. ‘JI~~w doniains can be used t,o implenient certain disc,rr,t iona.ry role based access control policies.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124607203","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Specifying and managing role-based access control within a corporate intranet","authors":"David F. Ferraiolo, John F. Barkley","doi":"10.1145/266741.266761","DOIUrl":"https://doi.org/10.1145/266741.266761","url":null,"abstract":"In order for intranets to reach their full potential, access control and authorization management mechanisms must be in place that can regulate user access to information in a manner that is consistent with the current set of laws, regulations, and practices that face businesses today. The purpose of RBAC on the Web would be to provide this access control service, thereby enabling the use of the Web for new and more sophisticated applications -to allow access to information and other resources that would otherwise not be possible given the existing lack of operational assurance. This paper describes an approach at providing these assurances through the use of RBAC for networked Web servers.","PeriodicalId":355233,"journal":{"name":"ACM Workshop on Role-Based Access Control","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127702392","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}