1. Cyber-Identity, Authority and Trust in an Uncertain World
Prof. Ravi Sandhu
Laboratory for Information Security Technology
George Mason University

2. Outline Perspective on security Role Based Access Control (RBAC)
Objective Model-Architecture Mechanism (OM-AM) Framework
Usage Control (UCON)

3. Security Conundrum Nobody knows WHAT security is
Some of us do know HOW to implement pieces of it
Result: hammers in search of nails

4. Security Confusion USAGE purpose INTEGRITY modification AVAILABILITY
electronic commerce, electronic business
DRM, client-side controls
INTEGRITY
modification
AVAILABILITY
access
CONFIDENTIALITY
disclosure

5. Success is largely unrecognized by the security community
Security Successes
On-line banking
On-line trading
Automatic teller machines (ATMs)
GSM phones
Set-top boxes
…………………….
Success is largely unrecognized
by the security community

6. Business models dominate
Good enough security
Real-world users
Security geeks
SECURE
EASY
end users
operations staff
help desk
whose security
perception or reality of security
System owner
Business models dominate
security models
COST
system solution
operational cost
opportunity cost
cost of fraud

7. Good enough security COST L M H Entrepreneurial mindset H 1 2 3
Academic
mindset R I S K 2 3 4 M L 3 4 5

8. RBAC96 model (Currently foundation of a NIST/ANSI/ISO standard)
ROLE HIERARCHIES
USER-ROLE
ASSIGNMENT
PERMISSIONS-ROLE
ASSIGNMENT
USERS
ROLES
PERMISSIONS
...
SESSIONS
CONSTRAINTS

9. Fundamental Theorem of RBAC
RBAC can be configured to do MAC
MAC is Mandatory Access Control as defined in the Orange Book
RBAC can be configured to do DAC
DAC is Discretionary Access Control as defined in the Orange Book
RBAC is policy neutral

10. THE OM-AM WAY A What? s u Objectives r Model a n Architecture c
Mechanism
How?

11. OM-AM AND MANDATORY ACCESS CONTROL (MAC)u r a n c e
What?
How?
No information leakage
Lattices (Bell-LaPadula)
Security kernel
Security labels

12. OM-AM AND DISCRETIONARY ACCESS CONTROL (DAC)u r a n c e
What?
How?
Owner-based discretion
numerous
ACLs, Capabilities, etc

13. OM-AM AND ROLE-BASED ACCESS CONTROL (RBAC)u r a n c e
What?
How?
Objective neutral
RBAC96, ARBAC97, etc.
user-pull, server-pull, etc.
certificates, tickets, PACs, etc.

14. RBAC96 Model ... ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE USERS
SESSIONS
ROLE HIERARCHIES
CONSTRAINTS
This is a somewhat busy slide
It shows a bird’s eye view of RBAC
There are many details that need to be debated and filled in
Some of these will be discussed in the subsequent panel
For our purpose the bird’s eye view will suffice

15. Server-Pull Architecture
Client
Server
User-role
Authorization
Server

16. User-Pull Architecture
Client
Server
User-role
Authorization
Server

17. Proxy-Based Architecture
Client
Proxy
Server
Server
User-role
Authorization
Server

18. Usage Control (UCON) Coverage
Protection Objectives
Sensitive information protection
IPR protection
Privacy protection
Protection Architectures
Server-side reference monitor
Client-side reference monitor
SRM & CRM

19. Core UCON (Usage Control) Models
ongoing
N/A
Continuity
Decision can be made during usage for continuous enforcement
Mutability
Attributes can be updated as side-effects of subjects’ actions

20. Examples Long-distance phone (pre-authorization with post-update)
Pre-paid phone card (ongoing-authorization with ongoing-update)
Pay-per-view (pre-authorization with pre-updates)
Click Ad within every 30 minutes (ongoing-obligation with ongoing-updates)
Business Hour (pre-/ongoing-condition)

21. Good enough security COST Entrepreneurial Mindset 80% problem
soft, informal
ordinary consumers L M H
Academic
Mindset
120% problem
hard, informal
techno-geeks H 1 2 3 R I S K 2 3 4 M L 3 4 5