We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byAudrey McDougall
Modified over 5 years ago
ISA 662 RBAC-MAC-DAC Prof. Ravi Sandhu
2 © Ravi Sandhu RBAC96 ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS ROLE HIERARCHIES CONSTRAINTS
3 © Ravi Sandhu HIERARCHICAL ROLES Engineer Hardware Engineer Software Engineer Supervising Engineer
4 © Ravi Sandhu WHAT IS THE POLICY IN RBAC? RBAC is policy neutral Role hierarchies facilitate security management Constraints facilitate non-discretionary policies
5 © Ravi Sandhu LBAC: LIBERAL *-PROPERTY H L M1M2 ReadWrite -+ +-
6 © Ravi Sandhu RBAC96: LIBERAL *-PROPERTY HR LR M1RM2R LW HW M1WM2W Read Write - +
7 © Ravi Sandhu RBAC96: LIBERAL *-PROPERTY user xR, user has clearance x user LW, independent of clearance Need constraints session xR iff session xW read can be assigned only to xR roles write can be assigned only to xW roles (O,read) assigned to xR iff (O,write) assigned to xW
8 © Ravi Sandhu LBAC: STRICT *-PROPERTY H L M1M2 ReadWrite - +
9 © Ravi Sandhu RBAC96: STRICT *-PROPERTY HR LR M1RM2R LWHWM1WM2W
10 © Ravi Sandhu Variations of DAC Strict DAC Liberal DAC
11 © Ravi Sandhu Strict DAC Only owner has discretionary authority to grant access to an object. Example: Alice has created an object (she is owner) and grants access to Bob. Now Bob cannot grant propagate the access to another user.
12 © Ravi Sandhu Liberal DAC Owner can delegate discretionary authority for granting access to other users. One Level grant Two Level Grant Multilevel Grant
13 © Ravi Sandhu One Level Grant Owner can delegate authority to another user but they cannot further delegate this power. Alice BobCharles
14 © Ravi Sandhu Two Level Grant In addition a one level grant the owner can allow some users to delegate grant authority to other users. Alice BobCharlesDorothy
15 © Ravi Sandhu Revocation Grant-Independent Revocation. Grant-Dependent Revocation.
16 © Ravi Sandhu Common Aspects Creation of an object in the system requires the simultaneous creation of three administrative roles OWN_O, PARENT_O, PARENTwithGRANT_O One regular role READ_O
OWN_OPARENTwithGRANT_OPARENT_OREAD_O Administration of roles associated with object O OWN_O PARENTwithGRANT_O PARENT_O Administrative role hierarchy
18 © Ravi Sandhu Common Aspects II We require simultaneous creation of Eight Permissions canRead_O destroyObjet_O addReadUser_O, deleteReadUser_O addParent_O, deleteParent_O addParentWithGrant_O, deleteParentWithGrant_O
19 © Ravi Sandhu Roles and associated Permissions OWN_O destroyObject_O, addParentWithGrant_O, deleteParentWithgrant_O PARENTwithGRANT_O addParent_O, deleteParent_O PARENT_O addReadUser_O, deleteReadUser_O READ_O canRead_O
20 © Ravi Sandhu Common Aspects III Destroying an object O requires deletion of four roles and eight permissions in addition of destroying the object O.
21 © Ravi Sandhu Strict DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1 Role PARENTwithGRANT_O = 0 Role PARENT_O = 0
22 © Ravi Sandhu One level DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1 Role PARENTwithGRANT_O = 0
23 © Ravi Sandhu Two Level DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1
24 © Ravi Sandhu U1_PARENT_O U1_READ_O U2_PARENT_O Un_PARENT_O U2_READ_O Un_READ_O READ_O role associated with members of PARENT_O
TWO STEP EQUATIONS 1. SOLVE FOR X 2. DO THE ADDITION STEP FIRST
You have been given a mission and a code. Use the code to complete the mission and you will save the world from obliteration…
Advanced Piloting Cruise Plot.
Cyber-Identity, Authority and Trust in an Uncertain World
1 ACSAC 2002 © Mohammad al-Kahtani 2002 A Model for Attribute-Based User-Role Assignment Mohammad A. Al-Kahtani Ravi Sandhu George Mason University SingleSignOn.net,
© 2004 Ravi Sandhu The Schematic Protection Model (SPM) Ravi Sandhu Laboratory for Information Security Technology George Mason University.
1 Framework for Role-Based Delegation Models (RBDMs) By: Ezedin S.Barka and Ravi Sandhu Laboratory Of Information Security Technology George Mason University.
INFS 767 Fall 2003 The RBAC96 Model Prof. Ravi Sandhu George Mason University.
Role-Based Access Control Prof. Ravi Sandhu George Mason University and NSD Security SACMAT 2003.
ARBAC99 (Model for Administration of Roles)
Ravi Sandhu Venkata Bhamidipati
ARBAC 97 (ADMINISTRATIVE RBAC)
Role Activation Hierarchies Ravi Sandhu George Mason University.
ACCESS CONTROL: THE NEGLECTED FRONTIER Ravi Sandhu George Mason University.
ROLE HIERARCHIES AND CONSTRAINTS FOR LATTICE-BASED ACCESS CONTROLS
SECURING CYBERSPACE: THE OM-AM, RBAC AND PKI ROADMAP Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University
How to do Discretionary Access Control Using Roles Ravi Sandhu Qamar Munawer.
Future Directions in Role-Based Access Control Models Ravi Sandhu Co-Founder and Chief Scientist SingleSignOn.Net & Professor of Information Technology.
ENGINEERING AUTHORITY AND TRUST IN CYBERSPACE: A ROLE-BASED APPROACH Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University.
A Logic Specification for Usage Control Xinwen Zhang, Jaehong Park Francesco Parisi-Presicce, Ravi Sandhu George Mason University SACMAT 2004.
© 2019 SlidePlayer.com Inc. All rights reserved.