Presentation is loading. Please wait.

Presentation is loading. Please wait.

Role-Based Access Control (RBAC)

Published byDrusilla Wells Modified over 6 years ago

Similar presentations

Presentation on theme: "Role-Based Access Control (RBAC)"— Presentation transcript:

1 Role-Based Access Control (RBAC)
CS 5323 Role-Based Access Control (RBAC) Prof. Ravi Sandhu Executive Director and Endowed Chair Lecture 9 © Ravi Sandhu World-Leading Research with Real-World Impact!

2 Access Control Fixed policy Ownership gives discretion
One-directional information flow Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Policy neutral Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Flexible policy © Ravi Sandhu World-Leading Research with Real-World Impact! 2

3 The RBAC Story Standard Adopted Proposed Standard RBAC96 paper
Ludwig Fuchs, Gunther Pernul and Ravi Sandhu, Roles in Information Security-A Survey and Classification of the Research Area, Computers & Security, Volume 30, Number 8, Nov. 2011, pages This is a somewhat busy slide It shows a bird’s eye view of RBAC There are many details that need to be debated and filled in Some of these will be discussed in the subsequent panel For our purpose the bird’s eye view will suffice © Ravi Sandhu World-Leading Research with Real-World Impact! 3

4 RBAC: Role-Based Access Control
Access is determined by roles A user’s roles are assigned by security administrators A role’s permissions are assigned by security administrators First emerged: mid 1970s First models: mid 1990s Is RBAC MAC or DAC or neither? RBAC can be configured to do MAC RBAC can be configured to do DAC RBAC is policy neutral RBAC is neither MAC nor DAC! © Ravi Sandhu World-Leading Research with Real-World Impact! 4

5 RBAC96 Model World-Leading Research with Real-World Impact!
© Ravi Sandhu World-Leading Research with Real-World Impact!

6 ... RBAC96 Model Family ROLE HIERARCHIES USER-ROLE ASSIGNMENT
PERMISSIONS-ROLE ASSIGNMENT USERS ROLES PERMISSIONS ... SESSIONS This is a somewhat busy slide It shows a bird’s eye view of RBAC There are many details that need to be debated and filled in Some of these will be discussed in the subsequent panel For our purpose the bird’s eye view will suffice CONSTRAINTS © Ravi Sandhu World-Leading Research with Real-World Impact! 6

7 RBAC96 Model Family RBAC3 ROLE HIERARCHIES + CONSTRAINTS RBAC1 ROLE
BASIC RBAC This is a somewhat busy slide It shows a bird’s eye view of RBAC There are many details that need to be debated and filled in Some of these will be discussed in the subsequent panel For our purpose the bird’s eye view will suffice © Ravi Sandhu World-Leading Research with Real-World Impact! 7

8 Founding Principles of RBAC96
Abstraction of Privileges Credit is different from Debit even though both require read and write Separation of Administrative Functions Separation of user-role assignment from role-permission assignment Least Privilege Right-size the roles Don’t activate all roles all the time Limit roles of a user Limit users in a role Separation of Duty Static separation: purchasing manager versus accounts payable manager Dynamic separation: cash-register clerk versus cash-register manager © Ravi Sandhu World-Leading Research with Real-World Impact! 8

9 These collections will vary over time
ROLES AS POLICY A role brings together a collection of users and a collection of permissions These collections will vary over time A role has significance and meaning beyond the particular users and permissions brought together at any moment © Ravi Sandhu World-Leading Research with Real-World Impact! 9

10 Groups are often defined as A role is
ROLES VERSUS GROUPS Groups are often defined as a collection of users A role is a collection of users and a collection of permissions Some authors define role as Most Operating Systems support groups BUT do not support selective activation of groups Selective activation conflicts with negative groups (or roles) © Ravi Sandhu World-Leading Research with Real-World Impact! 10

11 HIERARCHICAL ROLES Primary-Care Physician Specialist Physician
Health-Care Provider © Ravi Sandhu World-Leading Research with Real-World Impact! 11

12 HIERARCHICAL ROLES Engineer Hardware Software Supervising
© Ravi Sandhu World-Leading Research with Real-World Impact! 12

13 PRIVATE ROLES Engineer Hardware Software Supervising Engineer’
© Ravi Sandhu World-Leading Research with Real-World Impact! 13

14 Engineering Department (ED)
EXAMPLE ROLE HIERARCHY Director (DIR) Project Lead 1 (PL1) Project Lead 2 (PL2) Production 1 (P1) Quality 1 (Q1) Production 2 (P2) Quality 2 (Q2) Engineer 1 (E1) Engineer 2 (E2) Engineering Department (ED) PROJECT 1 PROJECT 2 Employee (E) © Ravi Sandhu World-Leading Research with Real-World Impact! 14

15 Engineering Department (ED)
EXAMPLE ROLE HIERARCHY Project Lead 1 (PL1) Project Lead 2 (PL2) Production 1 (P1) Quality 1 (Q1) Production 2 (P2) Quality 2 (Q2) Engineer 1 (E1) Engineer 2 (E2) Engineering Department (ED) PROJECT 1 PROJECT 2 Employee (E) © Ravi Sandhu World-Leading Research with Real-World Impact! 15

16 EXAMPLE ROLE HIERARCHY
Director (DIR) Project Lead 1 (PL1) Project Lead 2 (PL2) Production 1 (P1) Quality 1 (Q1) Production 2 (P2) Quality 2 (Q2) Engineer 1 (E1) Engineer 2 (E2) PROJECT 1 PROJECT 2 © Ravi Sandhu World-Leading Research with Real-World Impact! 16

17 EXAMPLE ROLE HIERARCHY
Project Lead 1 (PL1) Project Lead 2 (PL2) Production 1 (P1) Quality 1 (Q1) Production 2 (P2) Quality 2 (Q2) Engineer 1 (E1) Engineer 2 (E2) PROJECT 1 PROJECT 2 © Ravi Sandhu World-Leading Research with Real-World Impact! 17

18 Mutually Exclusive Roles
CONSTRAINTS Mutually Exclusive Roles Static Exclusion: The same individual can never hold both roles Dynamic Exclusion: The same individual can never hold both roles in the same context Mutually Exclusive Permissions Static Exclusion: The same role should never be assigned both permissions Dynamic Exclusion: The same role can never hold both permissions in the same context Cardinality Constraints on User-Role Assignment At most k users can belong to the role At least k users must belong to the role Exactly k users must belong to the role Cardinality Constraints on Permissions-Role Assignment At most k roles can get the permission At least k roles must get the permission Exactly k roles must get the permission © Ravi Sandhu World-Leading Research with Real-World Impact! 18

19 NIST RBAC Model World-Leading Research with Real-World Impact!
© Ravi Sandhu World-Leading Research with Real-World Impact!

20 NIST MODEL: CORE RBAC World-Leading Research with Real-World Impact!
© Ravi Sandhu World-Leading Research with Real-World Impact! 20

21 NIST MODEL: HIERARCHICAL RBAC
© Ravi Sandhu World-Leading Research with Real-World Impact! 21

22 SSD IN HIERARCHICAL RBAC
© Ravi Sandhu World-Leading Research with Real-World Impact! 22

23 DSD IN HIERARCHICAL RBAC
© Ravi Sandhu World-Leading Research with Real-World Impact! 23

24 NIST MODEL FAMILY World-Leading Research with Real-World Impact!
© Ravi Sandhu World-Leading Research with Real-World Impact! 24

25 Compare RBAC96 Model Family
ROLE HIERARCHIES + CONSTRAINTS RBAC1 ROLE HIERARCHIES RBAC2 CONSTRAINTS RBAC0 BASIC RBAC This is a somewhat busy slide It shows a bird’s eye view of RBAC There are many details that need to be debated and filled in Some of these will be discussed in the subsequent panel For our purpose the bird’s eye view will suffice © Ravi Sandhu World-Leading Research with Real-World Impact! 25

26 RBAC Administration World-Leading Research with Real-World Impact!
© Ravi Sandhu World-Leading Research with Real-World Impact!

27 ... RBAC96 Model Family ROLE HIERARCHIES USER-ROLE ASSIGNMENT
PERMISSIONS-ROLE ASSIGNMENT USERS ROLES PERMISSIONS ... SESSIONS This is a somewhat busy slide It shows a bird’s eye view of RBAC There are many details that need to be debated and filled in Some of these will be discussed in the subsequent panel For our purpose the bird’s eye view will suffice CONSTRAINTS © Ravi Sandhu World-Leading Research with Real-World Impact! 27

Download ppt "Role-Based Access Control (RBAC)"

Similar presentations

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
Access Control Prof. Ravi Sandhu Executive Director and Endowed Chair

Access Control Prof. Ravi Sandhu Executive Director and Endowed Chair
Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.

Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.
INFS 767 Fall 2003 The RBAC96 Model Prof. Ravi Sandhu George Mason University.

INFS 767 Fall 2003 The RBAC96 Model Prof. Ravi Sandhu George Mason University.
Role Activation Hierarchies Ravi Sandhu George Mason University.

Role Activation Hierarchies Ravi Sandhu George Mason University.
ACCESS CONTROL: THE NEGLECTED FRONTIER Ravi Sandhu George Mason University.

ACCESS CONTROL: THE NEGLECTED FRONTIER Ravi Sandhu George Mason University.
Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.

Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.
Institute for Cyber Security

Institute for Cyber Security
Future Directions in Role-Based Access Control Models Ravi Sandhu Co-Founder and Chief Scientist SingleSignOn.Net & Professor of Information Technology.

Future Directions in Role-Based Access Control Models Ravi Sandhu Co-Founder and Chief Scientist SingleSignOn.Net & Professor of Information Technology.
ENGINEERING AUTHORITY AND TRUST IN CYBERSPACE: A ROLE-BASED APPROACH Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University.

ENGINEERING AUTHORITY AND TRUST IN CYBERSPACE: A ROLE-BASED APPROACH Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University.
ROLE-BASED ACCESS CONTROL: A MULTI-DIMENSIONAL VIEW Ravi Sandhu, Edward Coyne, Hal Feinstein and Charles Youman Seta Corporation McLean, VA Ravi Sandhu.

ROLE-BASED ACCESS CONTROL: A MULTI-DIMENSIONAL VIEW Ravi Sandhu, Edward Coyne, Hal Feinstein and Charles Youman Seta Corporation McLean, VA Ravi Sandhu.
A THREE TIER ARCHITECTURE FOR ROLE-BASED ACCESS CONTROL Ravi Sandhu and Hal Feinstein Seta Corporation McLean, VA Ongoing NIST-funded project Other Project.

A THREE TIER ARCHITECTURE FOR ROLE-BASED ACCESS CONTROL Ravi Sandhu and Hal Feinstein Seta Corporation McLean, VA Ongoing NIST-funded project Other Project.
The RBAC96 Model Prof. Ravi Sandhu. 2 © Ravi Sandhu WHAT IS RBAC?  multidimensional  open ended  ranges from simple to sophisticated.

The RBAC96 Model Prof. Ravi Sandhu. 2 © Ravi Sandhu WHAT IS RBAC?  multidimensional  open ended  ranges from simple to sophisticated.
1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013

1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013
Access Control RBAC Database Activity Monitoring.

Access Control RBAC Database Activity Monitoring.
1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.

1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.
Attribute-Based Access Control Models and Beyond

Attribute-Based Access Control Models and Beyond
Role Based Access Control Venkata Marella. Access Control System Access control is the ability to permit or deny the use of a particular resource by a.

Role Based Access Control Venkata Marella. Access Control System Access control is the ability to permit or deny the use of a particular resource by a.
Security Fall 2009McFadyen ACS-49021 How do we protect the database from unauthorized access? Who can see employee salaries, student grades, … ? Who can.

Security Fall 2009McFadyen ACS How do we protect the database from unauthorized access? Who can see employee salaries, student grades, … ? Who can.
Security Fall 2006McFadyen ACS-49021 How do we protect the database from unauthorized access? Who can see employee salaries, student grades, … ? Who can.

Security Fall 2006McFadyen ACS How do we protect the database from unauthorized access? Who can see employee salaries, student grades, … ? Who can.

Similar presentations

Ads by Google