We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byAudrey McDougall
Modified over 3 years ago
ISA 662 RBAC-MAC-DAC Prof. Ravi Sandhu
2 © Ravi Sandhu RBAC96 ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS ROLE HIERARCHIES CONSTRAINTS
3 © Ravi Sandhu HIERARCHICAL ROLES Engineer Hardware Engineer Software Engineer Supervising Engineer
4 © Ravi Sandhu WHAT IS THE POLICY IN RBAC? RBAC is policy neutral Role hierarchies facilitate security management Constraints facilitate non-discretionary policies
5 © Ravi Sandhu LBAC: LIBERAL *-PROPERTY H L M1M2 ReadWrite -+ +-
6 © Ravi Sandhu RBAC96: LIBERAL *-PROPERTY HR LR M1RM2R LW HW M1WM2W Read Write - +
7 © Ravi Sandhu RBAC96: LIBERAL *-PROPERTY user xR, user has clearance x user LW, independent of clearance Need constraints session xR iff session xW read can be assigned only to xR roles write can be assigned only to xW roles (O,read) assigned to xR iff (O,write) assigned to xW
8 © Ravi Sandhu LBAC: STRICT *-PROPERTY H L M1M2 ReadWrite - +
9 © Ravi Sandhu RBAC96: STRICT *-PROPERTY HR LR M1RM2R LWHWM1WM2W
10 © Ravi Sandhu Variations of DAC Strict DAC Liberal DAC
11 © Ravi Sandhu Strict DAC Only owner has discretionary authority to grant access to an object. Example: Alice has created an object (she is owner) and grants access to Bob. Now Bob cannot grant propagate the access to another user.
12 © Ravi Sandhu Liberal DAC Owner can delegate discretionary authority for granting access to other users. One Level grant Two Level Grant Multilevel Grant
13 © Ravi Sandhu One Level Grant Owner can delegate authority to another user but they cannot further delegate this power. Alice BobCharles
14 © Ravi Sandhu Two Level Grant In addition a one level grant the owner can allow some users to delegate grant authority to other users. Alice BobCharlesDorothy
15 © Ravi Sandhu Revocation Grant-Independent Revocation. Grant-Dependent Revocation.
16 © Ravi Sandhu Common Aspects Creation of an object in the system requires the simultaneous creation of three administrative roles OWN_O, PARENT_O, PARENTwithGRANT_O One regular role READ_O
OWN_OPARENTwithGRANT_OPARENT_OREAD_O Administration of roles associated with object O OWN_O PARENTwithGRANT_O PARENT_O Administrative role hierarchy
18 © Ravi Sandhu Common Aspects II We require simultaneous creation of Eight Permissions canRead_O destroyObjet_O addReadUser_O, deleteReadUser_O addParent_O, deleteParent_O addParentWithGrant_O, deleteParentWithGrant_O
19 © Ravi Sandhu Roles and associated Permissions OWN_O destroyObject_O, addParentWithGrant_O, deleteParentWithgrant_O PARENTwithGRANT_O addParent_O, deleteParent_O PARENT_O addReadUser_O, deleteReadUser_O READ_O canRead_O
20 © Ravi Sandhu Common Aspects III Destroying an object O requires deletion of four roles and eight permissions in addition of destroying the object O.
21 © Ravi Sandhu Strict DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1 Role PARENTwithGRANT_O = 0 Role PARENT_O = 0
22 © Ravi Sandhu One level DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1 Role PARENTwithGRANT_O = 0
23 © Ravi Sandhu Two Level DAC in RBAC96 Cardinality constraints as: Role OWN_O = 1
24 © Ravi Sandhu U1_PARENT_O U1_READ_O U2_PARENT_O Un_PARENT_O U2_READ_O Un_READ_O READ_O role associated with members of PARENT_O
How to do Discretionary Access Control Using Roles Ravi Sandhu Qamar Munawer.
ROLE HIERARCHIES AND CONSTRAINTS FOR LATTICE-BASED ACCESS CONTROLS
Role Activation Hierarchies Ravi Sandhu George Mason University.
ACCESS CONTROL: THE NEGLECTED FRONTIER Ravi Sandhu George Mason University.
INFS 767 Fall 2003 The RBAC96 Model Prof. Ravi Sandhu George Mason University.
25 seconds left…...
Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies (2000) Author: Sylvia Osborn, Ravi Sandhu,Qamar Munawer.
The RBAC96 Model Prof. Ravi Sandhu. 2 © Ravi Sandhu WHAT IS RBAC? multidimensional open ended ranges from simple to sophisticated.
Jeopardy Q 1 Q 6 Q 11 Q 16 Q 21 Q 2 Q 7 Q 12 Q 17 Q 22 Q 3 Q 8 Q 13
ROLE-BASED ACCESS CONTROL: A MULTI-DIMENSIONAL VIEW Ravi Sandhu, Edward Coyne, Hal Feinstein and Charles Youman Seta Corporation McLean, VA Ravi Sandhu.
Role-Based Access Control Prof. Ravi Sandhu George Mason University and NSD Security SACMAT 2003.
We will resume in: 25 Minutes.
A THREE TIER ARCHITECTURE FOR ROLE-BASED ACCESS CONTROL Ravi Sandhu and Hal Feinstein Seta Corporation McLean, VA Ongoing NIST-funded project Other Project.
1 Framework for Role-Based Delegation Models (RBDMs) By: Ezedin S.Barka and Ravi Sandhu Laboratory Of Information Security Technology George Mason University.
Engineering Authority and Trust in Cyberspace: The OM-AM and RBAC Way Prof. Ravi Sandhu George Mason University
A Role-Based Delegation Model and some extensions By: Ezedin S.Barka Ravi Sandhu George Mason University.
Addition 1’s to 20.
Business Transaction Management Software for Application Coordination 1 Business Processes and Coordination.
© 2017 SlidePlayer.com Inc. All rights reserved.