Multilevel security in the UNIX tradition
Software—Practice & Experience
Modeling mandatory access control in role-based security systems
Proceedings of the ninth annual IFIP TC11 WG11.3 working conference on Database security IX : status and prospects: status and prospects
A decentralized model for information flow control
Proceedings of the sixteenth ACM symposium on Operating systems principles
Mandatory access control and role-based access control revisited
RBAC '97 Proceedings of the second ACM workshop on Role-based access control
Exception-based information flow control in object-oriented systems
ACM Transactions on Information and System Security (TISSEC)
JFlow: practical mostly-static information flow control
Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Configuring role-based access control to enforce mandatory and discretionary access control policies
ACM Transactions on Information and System Security (TISSEC)
Certification of programs for secure information flow
Communications of the ACM
Protecting privacy using the decentralized label model
ACM Transactions on Software Engineering and Methodology (TOSEM)
Proposed NIST standard for role-based access control
ACM Transactions on Information and System Security (TISSEC)
Information Flow Control in Object-Oriented Systems
IEEE Transactions on Knowledge and Data Engineering
Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects
Role Hierarchies and Constraints for Lattice-Based Access Controls
ESORICS '96 Proceedings of the 4th European Symposium on Research in Computer Security: Computer Security
Information Flow in a Purpose-Oriented Access Control Model
ICPADS '97 Proceedings of the 1997 International Conference on Parallel and Distributed Systems
Specifying Application-level Security in Workflow Systems
DEXA '98 Proceedings of the 9th International Workshop on Database and Expert Systems Applications
An Object-Oriented RBAC Model for Distributed System
WICSA '01 Proceedings of the Working IEEE/IFIP Conference on Software Architecture
A Purpose-Oriented Access Control Model
ICOIN '98 Proceedings of the 13th International Conference on Information Networking
Information Flow Control in Role-Based Model for Distributed Objects
ICPADS '01 Proceedings of the Eighth International Conference on Parallel and Distributed Systems
Providing flexibility in information flow control for object oriented systems
SP '97 Proceedings of the 1997 IEEE Symposium on Security and Privacy
Embedding role-based access control model in object-oriented systems to protect privacy
Journal of Systems and Software
An extended XACML model to ensure secure information access for web services
Journal of Systems and Software
Improved multilevel security with latent semantic indexing
Expert Systems with Applications: An International Journal
| Hi-index | 0.00 |
An information flow control model prevents information leakage during the execution of an application. Quite a few information flow control models have been developed. We also developed information flow control models based on role-based access control (RBAC). Our research revealed that user relationships might result in role relationships when users play roles in an application. Moreover, role relationships may cause role permission change. We also identified that role relationship change may invalidate the results of previous join operations (which prevent indirect information leakage). According to our survey, we cannot identify a model that manages role relationships well. Moreover, we cannot identify a model that corrects the invalidated join results. This paper presents an information flow control model that manages role relationships and corrects the invalidated join results. It is an extension of our previous work OORBAC (object-oriented RBAC). The model is named EOORBAC (extended OORBAC). We evaluate EOORBAC against OORBAC. The evaluation result is also shown in this paper.