An integrated approach to engineer and enforce context constraints in RBAC environments
Authors:
Open Access
- 1 August 2004
- journal article
- Published by Association for Computing Machinery (ACM) in ACM Transactions on Information and System Security
- Vol. 7 (3) , 392-427
Abstract
We present an approach that uses special purpose role-based access control (RBAC) constraints to base certain access control decisions on context information. In our approach a context constraint is defined as a dynamic RBAC constraint that checks the actual values of one or more contextual attributes for predefined conditions. If these conditions are satisfied, the corresponding access request can be permitted. Accordingly, a conditional permission is an RBAC permission that is constrained by one or more context constraints. We present an engineering process for context constraints that is based on goal-oriented requirements engineering techniques, and describe how we extended the design and implementation of an existing RBAC service to enable the enforcement of context constraints. With our approach we aim to preserve the advantages of RBAC and offer an additional means for the definition and enforcement of fine-grained context-dependent access control policies.Keywords
This publication has 20 references indexed in Scilit:
- A content-based authorization model for digital librariesIEEE Transactions on Knowledge and Data Engineering, 2002
- An authorization model for temporal and derived dataACM Transactions on Information and System Security, 2002
- TRBACACM Transactions on Information and System Security, 2001
- Proposed NIST standard for role-based access controlACM Transactions on Information and System Security, 2001
- Understanding and Using ContextPersonal and Ubiquitous Computing, 2001
- Role-based authorization constraints specificationACM Transactions on Information and System Security, 2000
- The specification and enforcement of authorization constraints in workflow management systemsACM Transactions on Information and System Security, 1999
- A role-based access control model and reference implementation within a corporate intranetACM Transactions on Information and System Security, 1999
- Towards a Theory of Declarative Knowledge1988
- A lattice model of secure information flowCommunications of the ACM, 1976