Extended Privilege Inheritance in RBAC

M.A.C. Dekker; J.G. Cederquist; J. Crampton; Sandro Etalle

doi:10.1145/1229285.1229335

Extended Privilege Inheritance in RBAC

M.A.C. Dekker, J.G. Cederquist, J. Crampton, Sandro Etalle

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

4 Citations (Scopus)

7 Downloads (Pure)

Abstract

In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.

Original language	Undefined
Title of host publication	Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007
Editors	R. Deng, P. Samarati
Place of Publication	New York
Publisher	ACM Press
Pages	383-385
Number of pages	3
ISBN (Print)	1-59593-574-6
DOIs	https://doi.org/10.1145/1229285.1229335
Publication status	Published - 2007
Event	2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS 2007 - Singapore, Singapore Duration: 20 Mar 2007 → 22 Mar 2007 Conference number: 2

Publication series

Name	Conference on Computer and Communications Security
Publisher	ACM Press
Number	LNCS4549

Conference

Conference	2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS 2007
Abbreviated title	ASIACCS
Country/Territory	Singapore
City	Singapore
Period	20/03/07 → 22/03/07

Keywords

EWI-10740
SCS-Cybersecurity
METIS-241765
RBAC
Access Control
administrative privileges
IR-61839

Access to Document

10.1145/1229285.1229335

http://eprints.eemcs.utwente.nl/secure2/10740/01/p383-dekker.pdf

Cite this

Dekker, M. A. C., Cederquist, J. G., Crampton, J., & Etalle, S. (2007). Extended Privilege Inheritance in RBAC. In R. Deng, & P. Samarati (Eds.), Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007 (pp. 383-385). Article 10.1145/1229285.1229335 (Conference on Computer and Communications Security; No. LNCS4549). ACM Press. https://doi.org/10.1145/1229285.1229335

@inproceedings{a40dbdb05c6a459095ccc85ddcb13e2d,

title = "Extended Privilege Inheritance in RBAC",

abstract = "In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.",

keywords = "EWI-10740, SCS-Cybersecurity, METIS-241765, RBAC, Access Control, administrative privileges, IR-61839",

author = "M.A.C. Dekker and J.G. Cederquist and J. Crampton and Sandro Etalle",

note = "10.1145/1229285.1229335 ; 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS 2007 ; Conference date: 20-03-2007 Through 22-03-2007",

year = "2007",

doi = "10.1145/1229285.1229335",

language = "Undefined",

isbn = "1-59593-574-6",

series = "Conference on Computer and Communications Security",

publisher = "ACM Press",

number = "LNCS4549",

pages = "383--385",

editor = "R. Deng and P. Samarati",

booktitle = "Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007",

}

Dekker, MAC, Cederquist, JG, Crampton, J & Etalle, S 2007, Extended Privilege Inheritance in RBAC. in R Deng & P Samarati (eds), Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007., 10.1145/1229285.1229335, Conference on Computer and Communications Security, no. LNCS4549, ACM Press, New York, pp. 383-385, 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS 2007, Singapore, Singapore, 20/03/07. https://doi.org/10.1145/1229285.1229335

Extended Privilege Inheritance in RBAC. / Dekker, M.A.C.; Cederquist, J.G.; Crampton, J. et al.
Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007. ed. / R. Deng; P. Samarati. New York: ACM Press, 2007. p. 383-385 10.1145/1229285.1229335 (Conference on Computer and Communications Security; No. LNCS4549).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Extended Privilege Inheritance in RBAC

AU - Dekker, M.A.C.

AU - Cederquist, J.G.

AU - Crampton, J.

AU - Etalle, Sandro

N1 - Conference code: 2

PY - 2007

Y1 - 2007

N2 - In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.

AB - In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.

KW - EWI-10740

KW - SCS-Cybersecurity

KW - METIS-241765

KW - RBAC

KW - Access Control

KW - administrative privileges

KW - IR-61839

U2 - 10.1145/1229285.1229335

DO - 10.1145/1229285.1229335

M3 - Conference contribution

SN - 1-59593-574-6

T3 - Conference on Computer and Communications Security

SP - 383

EP - 385

BT - Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007

A2 - Deng, R.

A2 - Samarati, P.

PB - ACM Press

CY - New York

T2 - 2nd ACM Symposium on Information, Computer and Communications Security, ASIACCS 2007

Y2 - 20 March 2007 through 22 March 2007

ER -

Dekker MAC, Cederquist JG, Crampton J, Etalle S. Extended Privilege Inheritance in RBAC. In Deng R, Samarati P, editors, Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS 2007. New York: ACM Press. 2007. p. 383-385. 10.1145/1229285.1229335. (Conference on Computer and Communications Security; LNCS4549). doi: 10.1145/1229285.1229335