Presentation is loading. Please wait.

Presentation is loading. Please wait.

Ravi Sandhu Venkata Bhamidipati Laboratory for Information Security Technology (LIST) George Mason University Role-Based Administration of User-Role Assignment:

Similar presentations


Presentation on theme: "Ravi Sandhu Venkata Bhamidipati Laboratory for Information Security Technology (LIST) George Mason University Role-Based Administration of User-Role Assignment:"— Presentation transcript:

1 Ravi Sandhu Venkata Bhamidipati Laboratory for Information Security Technology (LIST) George Mason University Role-Based Administration of User-Role Assignment: The URA97 Model and its Oracle Implementation

2 2 © Ravi Sandhu 1997 OUTLINE u RBAC96 review u URA97 model u URA97 Oracle implementation u Closing remarks

3 3 © Ravi Sandhu 1997 RBAC96 ROLES USERS PERMISSIONS... ADMIN ROLES ADMIN PERMISSIONS CONSTRAINTS SESSIONS

4 4 © Ravi Sandhu 1997 RBAC96: RBAC0 ROLES USERS PERMISSIONS... SESSIONS

5 5 © Ravi Sandhu 1997 RBAC96: RBAC1 ROLES USERS PERMISSIONS... SESSIONS

6 6 © Ravi Sandhu 1997 RBAC96 : RBAC2 ROLES USERS PERMISSIONS... CONSTRAINTS SESSIONS

7 7 © Ravi Sandhu 1997 RBAC96 : RBAC3 ROLES USERS PERMISSIONS... CONSTRAINTS SESSIONS

8 8 © Ravi Sandhu 1997 RBAC96 ROLES USERS PERMISSIONS... ADMIN ROLES ADMIN PERMISSIONS CONSTRAINTS SESSIONS

9 9 © Ravi Sandhu 1997 RBAC96 RBAC2RBAC1 RBAC0 RBAC3 ARBAC2ARBAC1 ARBAC0 ARBAC3

10 10 © Ravi Sandhu 1997 SCALE AND RATE OF CHANGE u roles: 100s or 1000s u users: 1000s or 10,000s or more u Frequent changes to l user-role assignment l permission-role assignment u Less frequent changes for l role hierarchy

11 11 © Ravi Sandhu 1997 ADMINISTRATIVE RBAC l user-role assignment l permission-role assignment l role-role hierarchy

12 12 © Ravi Sandhu 1997 EXAMPLE ROLE HIERARCHY Employee (E) Engineering Department (ED) Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Director (DIR) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

13 13 © Ravi Sandhu 1997 EXAMPLE ADMINISTRATIVE ROLE HIERARCHY Senior Security Officer (SSO) Department Security Officer (DSO) Project Security Officer 1 (PSO1) Project Security Officer 2 (PSO2)

14 14 © Ravi Sandhu 1997 URA97 GRANT MODEL: can-assign ARolePrereq RoleRole Range PSO1ED[E1,PL1) PSO2ED[E2,PL2) DSOED(ED,DIR) SSOE[ED,ED] SSOED(ED,DIR]

15 15 © Ravi Sandhu 1997 URA97 GRANT MODEL : can-assign ARolePrereq CondRole Range PSO1ED[E1,E1] PSO1ED & ¬ P1[Q1,Q1] PSO1ED & ¬ Q1[P1,P1] PSO2ED[E2,E2] PSO2ED & ¬ P2[Q2,Q2] PSO2ED & ¬ Q2[P2,P2]

16 16 © Ravi Sandhu 1997 URA97 GRANT MODEL u redundant assignments to senior and junior roles l are allowed l are useful

17 17 © Ravi Sandhu 1997 URA97 REVOKE MODEL u WEAK REVOCATION l revokes explicit membership in a role l independent of who did the assignment

18 18 © Ravi Sandhu 1997 URA97 REVOKE MODEL u STRONG REVOCATION l revokes explicit membership in a role and its seniors l authorized only if corresponding weak revokes are authorized l alternatives n all-or-nothing n revoke within range

19 19 © Ravi Sandhu 1997 URA97 REVOKE MODEL : can-revoke ARoleRole Range PSO1[E1,PL1) PSO2[E2,PL2) DSO(ED,DIR) SSO[ED,DIR]

20 20 © Ravi Sandhu 1997 ORACLE ROLES u support RBAC1 u administrative model has strong discretionary flavor l administrative authority on role implies n can grant role to any user or role n can grant role to any role l anyone with grant option on a permission can grant it to any role

21 21 © Ravi Sandhu 1997 URA97 IN ORACLE u administrative option for all roles is retained solely with DBA l never given to any user u use generic stored procedures with URA97 can-assign and can-revoke implemented as relations

22 22 © Ravi Sandhu 1997 URA97 IN ORACLE u Oracle primitives for traversing role hierarchy need to be extended

23 23 © Ravi Sandhu 1997 can-assign in dnf ER DIAGRAM Admin Role PreCondition Min_Int Min Role Max Role Max_Int CAN_ASSIGN PreCondition AND set name NOT set name CAN_ASSIGN2 NOT set name NOT roles CAN_ASSIGN4 AND set name AND roles CAN_ASSIGN3

24 24 © Ravi Sandhu 1997 can-revoke RELATION Admin Role Min_Int Min Role Max Role Max_Int CAN_REVOKE

25 25 © Ravi Sandhu 1997 ORACLE STORED PROCEDURES u can extend Oracle access control model u limitation l stored procedure can determine who the user is BUT l cannot determine active roles of the user

26 26 © Ravi Sandhu 1997 URA97 STORED PROCEDURES u ASSIGN(user, trole, arole) u WEAK_REVOKE(user, trole, arole) u STRONG_REVOKE(user, trole, arole) l user: user being added to trole l trole: target role l arole: administrative role used for this operation n due to Oracle limitations

27 27 © Ravi Sandhu 1997 CLOSING REMARKS: PREVIEW OF WORK IN PROGRESS u user-role assignment l URA97 and Oracle, this paper l other platforms u permission-role assignment l PRA97, dual of URA97 l Oracle implementation

28 28 © Ravi Sandhu 1997 CLOSING REMARKS: PREVIEW OF WORK IN PROGRESS u role-role hierarchy l user-only roles (groups): like URA97 l permission-only roles: like PRA97 l user and permission roles: RRA97


Download ppt "Ravi Sandhu Venkata Bhamidipati Laboratory for Information Security Technology (LIST) George Mason University Role-Based Administration of User-Role Assignment:"

Similar presentations


Ads by Google