A proposal for a new block encryption standard
EUROCRYPT '90 Proceedings of the workshop on the theory and application of cryptographic techniques on Advances in cryptology
The official PGP user's guide
Role-Based Access Control Models
Computer
Design for dynamic user-role-based security
Computers and Security
The management of computer security profiles using a role-oriented approach
Computers and Security
Proceedings of the second ACM workshop on Role-based access control
Second ACM Workshop on Role-Based Access Control
Rationale for the RBAC96 family of access control models
RBAC '95 Proceedings of the first ACM Workshop on Role-based access control
Decentralized user-role assignment for Web-based intranets
RBAC '98 Proceedings of the third ACM workshop on Role-based access control
The Unified Modeling Language user guide
The Unified Modeling Language user guide
The ARBAC97 model for role-based administration of roles
ACM Transactions on Information and System Security (TISSEC) - Special issue on role-based access control
RBAC on the Web by smart certificates
RBAC '99 Proceedings of the fourth ACM workshop on Role-based access control
Injecting RBAC to secure a Web-based workflow system
RBAC '00 Proceedings of the fifth ACM workshop on Role-based access control
Configuring role-based access control to enforce mandatory and discretionary access control policies
ACM Transactions on Information and System Security (TISSEC)
A method for obtaining digital signatures and public-key cryptosystems
Communications of the ACM
Role-based authorization constraints specification
ACM Transactions on Information and System Security (TISSEC)
Understanding and Deploying LDAP Directory Services
Understanding and Deploying LDAP Directory Services
IEEE Internet Computing
Access Rights Administration in Role-Based Security Systems
Proceedings of the IFIP WG11.3 Working Conference on Database Security VII
RBAC on the Web by Secure Cookies
Proceedings of the IFIP WG 11.3 Thirteenth International Conference on Database Security: Research Advances in Database and Information Systems Security
Binding identities and attributes using digitally signed certificates
ACSAC '00 Proceedings of the 16th Annual Computer Security Applications Conference
A Formal Model for Role-Based Access Control with Constraints
CSFW '96 Proceedings of the 9th IEEE workshop on Computer Security Foundations
Analysis of the SSL 3.0 protocol
WOEC'96 Proceedings of the 2nd conference on Proceedings of the Second USENIX Workshop on Electronic Commerce - Volume 2
An authorization model for a public key management service
ACM Transactions on Information and System Security (TISSEC)
A fine-grained access control system for XML documents
ACM Transactions on Information and System Security (TISSEC)
Temporal hierarchies and inheritance semantics for GTRBAC
SACMAT '02 Proceedings of the seventh ACM symposium on Access control models and technologies
A secure workflow system for dynamic collaboration
Sec '01 Proceedings of the 16th international conference on Information security: Trusted information: the new decade challenge
Controlling Access to XML Documents
IEEE Internet Computing
Developing Secure Web Applications
IEEE Internet Computing
Anonymity and accountability in self-organizing electronic communities
Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society
Authorization Based on Evidence and Trust
DaWaK 2000 Proceedings of the 4th International Conference on Data Warehousing and Knowledge Discovery
Access control with IBM Tivoli access manager
ACM Transactions on Information and System Security (TISSEC)
Role-Based Access Control With X.509 Attribute Certificates
IEEE Internet Computing
The PERMIS X.509 role based privilege management infrastructure
Future Generation Computer Systems - Special section: Selected papers from the TERENA networking conference 2002
Role-based access control for collaborative enterprise in peer-to-peer computing environments
Proceedings of the eighth ACM symposium on Access control models and technologies
The tees confidentiality model: an authorisation model for identities and roles
Proceedings of the eighth ACM symposium on Access control models and technologies
Induced role hierarchies with attribute-based RBAC
Proceedings of the eighth ACM symposium on Access control models and technologies
Implementing role based access control for federated information systems on the web
ACSW Frontiers '03 Proceedings of the Australasian information security workshop conference on ACSW frontiers 2003 - Volume 21
Design and implementation of a fine-grained menu control processor for web-based information systems
Future Generation Computer Systems - Selected papers on theoretical and computational aspects of structural dynamical systems in linear algebra and control
An access control framework for business processes for web services
Proceedings of the 2003 ACM workshop on XML security
Proceedings of the 2003 workshop on New security paradigms
Securing web application code by static analysis and runtime protection
Proceedings of the 13th international conference on World Wide Web
On the role of roles: from role-based to role-sensitive access control
Proceedings of the ninth ACM symposium on Access control models and technologies
A composite rbac approach for large, complex organizations
Proceedings of the ninth ACM symposium on Access control models and technologies
Access control in collaborative systems
ACM Computing Surveys (CSUR)
SmartGate: a smart push-pull approach to support role-based security in web gateways
Proceedings of the 2005 ACM symposium on Applied computing
IEEE Transactions on Dependable and Secure Computing
Decentralized authorization and data security in web content delivery
Proceedings of the 2007 ACM symposium on Applied computing
Identities Management for E-Commerce and Collaboration Applications
International Journal of Electronic Commerce
Formal foundations for hybrid hierarchies in GTRBAC
ACM Transactions on Information and System Security (TISSEC)
Designing secure e-commerce with role-based access control
International Journal of Web Engineering and Technology
Towards trusted intelligence information sharing
Proceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics
Analysis of ANSI RBAC Support in COM+
Computer Standards & Interfaces
A structure-based clustering on LDAP directory information
ISMIS'08 Proceedings of the 17th international conference on Foundations of intelligent systems
Retelab: A geospatial grid web laboratory for the oceanographic research community
Future Generation Computer Systems
Detection of anomalous insiders in collaborative environments via relational analysis of access logs
Proceedings of the first ACM conference on Data and application security and privacy
A distributed authentication mechanism for sharing an overlay network among multiple organizations
Proceedings of the 12th International Conference on Information Integration and Web-based Applications & Services
A Clustering-Driven LDAP Framework
ACM Transactions on the Web (TWEB)
Proceedings of the 7th ACM symposium on QoS and security for wireless and mobile networks
Access control in geographic databases
CoMoGIS'06 Proceedings of the 2006 international conference on Advances in Conceptual Modeling: theory and practice
λ-RBAC: programming with role-based access control
ICALP'06 Proceedings of the 33rd international conference on Automata, Languages and Programming - Volume Part II
Access control requirements for preventing insider threats
ISI'06 Proceedings of the 4th IEEE international conference on Intelligence and Security Informatics
ICCSA'10 Proceedings of the 2010 international conference on Computational Science and Its Applications - Volume Part IV
Trusted identity and session management using secure cookies
DBSec'05 Proceedings of the 19th annual IFIP WG 11.3 working conference on Data and Applications Security
Development of a flexible PERMIS authorisation module for shibboleth and apache server
EuroPKI'05 Proceedings of the Second European conference on Public Key Infrastructure
Interactive credential negotiation for stateful business processes
iTrust'05 Proceedings of the Third international conference on Trust Management
Non-linear and non-group cellular automata chaining technique for cryptographic applications
Mathematical and Computer Modelling: An International Journal
Consistency of user attribute in federated systems
TrustBus'07 Proceedings of the 4th international conference on Trust, Privacy and Security in Digital Business
Ontology based hybrid access control for automatic interoperation
ATC'07 Proceedings of the 4th international conference on Autonomic and Trusted Computing
On securing communications among federated health information systems
SAFECOMP'12 Proceedings of the 2012 international conference on Computer Safety, Reliability, and Security
Mining Deviations from Patient Care Pathways via Electronic Medical Record System Audits
ACM Transactions on Management Information Systems (TMIS) - Special Issue on Informatics for Smart Health and Wellbeing
| Hi-index | 0.00 |
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.