Extended privilege inheritance in RBAC

M.A.C. Dekker, J.G. Cederquist, J. Crampton, S. Etalle

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    4 Citations (Scopus)

    Abstract

    In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.
    Original languageEnglish
    Title of host publicationProceedings of the 2007 ACM Symposium on Information, Computer and Communications Security (ASIACCS 2007) 20-22 March 2007, Singapore
    EditorsF. Bao, S. Miller
    Place of PublicationNew York
    PublisherAssociation for Computing Machinery, Inc
    Pages383-385
    ISBN (Print)1-59593-574-6
    Publication statusPublished - 2007
    EventASIACCS 2007 - Singapore
    Duration: 20 Mar 200722 Mar 2007

    Conference

    ConferenceASIACCS 2007
    CitySingapore
    Period20/03/0722/03/07

    Fingerprint

    Dive into the research topics of 'Extended privilege inheritance in RBAC'. Together they form a unique fingerprint.

    Cite this