Role-Based Access Control Models
Computer
Specifying and managing role-based access control within a corporate intranet
RBAC '97 Proceedings of the second ACM workshop on Role-based access control
Comparing simple role based access control models and access control lists
RBAC '97 Proceedings of the second ACM workshop on Role-based access control
Future directions in role-based access control
RBAC '95 Proceedings of the first ACM Workshop on Role-based access control
Cryptography and network security (2nd ed.): principles and practice
Cryptography and network security (2nd ed.): principles and practice
Formal specification for role based access control user/role and role/role relationship management
RBAC '98 Proceedings of the third ACM workshop on Role-based access control
A role-based access control model and reference implementation within a corporate intranet
ACM Transactions on Information and System Security (TISSEC) - Special issue on role-based access control
The NIST model for role-based access control: towards a unified standard
RBAC '00 Proceedings of the fifth ACM workshop on Role-based access control
Hacking Exposed; Network Security Secrets and Solutions
Hacking Exposed; Network Security Secrets and Solutions
| Hi-index | 0.00 |
Security is the prime concern in present day computing. The existing literature deals with the ways in which system security gets breached, the people involved in such activities (hackers) and their techniques. An equal amount of work has gone into preventive and corrective measures for security.A very large fraction of existing effort is based on what could be described as a 'stimuli-response' approach to security; characterized by the repetition of the following cycle: hackers find a loophole in the system, hack the system, system designers become aware of the attack and trace the loophole, they offer a patch to fix the loophole, system functions properly until hackers find another loophole.Intuitively, one can realize that, such a treatment of a subject, progressively growing in its importance, cannot lead us to permanent solutions and foolproof architectures. Though workable solutions may seem near at hand, they would not be durable and would need frequent replacement.Hence, a more systematic and formal treatment of the subject of security will be more appropriate. Such a treatment enables one to conceptualize the property of security associated with a system, and the phenomenon of a security breach, in a more concrete fashion. This is expected to lead one to more definitive results and enduring architectures for system security.This paper seeks to describe security from a theoretical perspective. We begin with the observation of an isolated, standalone system and build a formalism for the security of such a system by prescribing adherence to a defined model of systems. We then proceed to the case of a network of systems and extend the formalism for the security of such a network. Not only does this paper describe the evolution of the thought process associated with the construction of the formalism, but also proposes sample system architectures within the framework of the formalism, that can translate directly into real world implementations. Sample architectures are provided for a single system as well as a network of systems.In conclusion, we present an analysis and evaluation of the formalism and associated architecture. We also discuss means of realizing the framework of the formalism in modern computing environments, detailing the design process involved in the same, through a case study.