Role-based Access Control

, by Ferraiolo, David F.; Kuhn, D. Richard; Chandramouli, Ramaswamy

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9781596931138 | 1596931132
Cover: Paperback
Copyright: 2/1/2007

eBook

Available Instantly

Online: 1825 Days

Downloadable: Lifetime Access

$106.88

This revised edition of the Artech House bestseller, Role-Based Access Control, offers the very latest details on this sophisticated security model aimed at reducing the cost and complexity of security administration for large networked applications. This unique resource covers all facets of RBAC, from its solid model-theoretic foundations to its implementation within commercial products.

Preface	p. xv
Acknowledgments	p. xix
Introduction	p. 1
The purpose and fundamentals of access control	p. 2
Authorization versus authentication	p. 3
Users, subjects, objects, operations, and permissions	p. 4
Least privilege	p. 5
A brief history of access control	p. 6
Access control in the mainframe era	p. 6
Department of Defense standards	p. 8
Clark-Wilson model	p. 9
Origins of RBAC	p. 9
Comparing RBAC to DAC and MAC	p. 17
RBAC and the enterprise	p. 18
Economics of RBAC	p. 19
Authorization management and resource provisioning	p. 20
References	p. 24
Access Control: Properties, Policies, and Models	p. 27
Access control: objectives and enforcement artifacts	p. 27
Access control: core entities and principles	p. 30
Subjects and objects	p. 30
Principles of secure design	p. 31
Reference monitor and security kernel	p. 33
Completeness	p. 34
Isolation	p. 35
Verifiability	p. 36
The reference monitor-necessary, but not sufficient	p. 37
Access control matrix	p. 37
Access control data structures	p. 42
Capability lists and access control lists (ACLs)	p. 42
Protection bits	p. 44
Discretionary access control (DAC) policies	p. 44
MAC policies and models	p. 45
Bell-LaPadula model	p. 46
Biba's integrity model	p. 47
The Clark-Wilson model	p. 48
The Chinese wall policy model	p. 50
The Brewer-Nash model	p. 51
Domain-type enforcement (DTE) model	p. 52
References	p. 54
Core RBAC Features	p. 57
Roles versus ACL groups	p. 59
Core RBAC	p. 61
Administrative support	p. 61
Permissions	p. 62
Role activation	p. 64
Mapping the enterprise view to the system view	p. 65
Global users and roles and indirect role privileges	p. 68
Mapping permissions into privileges	p. 69
Role Hierarchies	p. 73
Building role hierarchies from flat roles	p. 74
Inheritance schemes	p. 75
Direct privilege inheritance	p. 75
Permission and user membership inheritance	p. 76
User containment and indirect privilege inheritance	p. 78
Hierarchy structures and inheritance forms	p. 81
Connector roles	p. 82
Organization chart hierarchies	p. 85
Geographical regions	p. 87
Accounting for role types	p. 89
General and limited role hierarchies	p. 90
Accounting for the Stanford model	p. 93
References	p. 95
SoD and Constraints in RBAC Systems	p. 97
Types of SoD	p. 100
Static SoD	p. 100
Dynamic SoD	p. 104
Operational SoD	p. 105
History and object-based SoD	p. 106
Using SoD in real systems	p. 107
SoD in role hierarchies	p. 108
Static and dynamic constraints	p. 109
Mutual exclusion	p. 110
Effects of privilege assignment	p. 111
Assigning privileges to roles	p. 113
Assigning roles to users	p. 114
Temporal constraints in RBAC	p. 118
Need for temporal constraints	p. 118
Taxonomy of temporal constraints	p. 119
Associated requirements for supporting temporal constraints	p. 122
References	p. 123
RBAC, MAC, and DAC	p. 127
Enforcing DAC using RBAC	p. 128
Configuring RBAC for DAC	p. 129
DAC with grant-independent revocation	p. 130
Additional considerations for grant-dependent revocation	p. 131
Enforcing MAC on RBAC systems	p. 131
Configuring RBAC for MAC using static constraints	p. 132
Configuring RBAC for MAC using dynamic constraints	p. 133
Implementing RBAC on MLS systems	p. 135
Roles and privilege sets	p. 138
Assignment of categories to privilege sets	p. 139
Assignment of categories to roles	p. 140
Example of MLS to RBAC mapping	p. 141
Running RBAC and MAC simultaneously	p. 143
References	p. 144
Privacy and Regulatory Issues	p. 147
Privacy requirement and access control Framework	p. 148
Incorporating privacy policies into the policy specification module	p. 148
Enhance RBAC model with privacy-related entities and relationships	p. 151
Justifications for additional entities in the RBAC model	p. 151
Business purpose entity	p. 153
Data usage entity	p. 154
Privacy-aware RBAC model	p. 155
Integrate privacy policy support in the role engineering process	p. 155
Identifying business purposes and role-business purpose relationship instances	p. 157
Identifying business purpose-task relationship instances	p. 157
Identifying data usage entities and data usage-data object relationship instances	p. 158
Authorization using privacy-RBAC-ACF	p. 160
RBAC and regulatory compliance	p. 162
Sarbanes-Oxley Act compliance	p. 164
Gramm-Leach-Bliley Act and HIPAA compliance	p. 166
Compliance and the RBAC model	p. 166
Considerations in using RBAC in regulatory compliance	p. 167
References	p. 168
RBAC Standards and Profiles	p. 171
The ANSI/INCITS RBAC standard	p. 171
Overview	p. 171
The RBAC reference model	p. 172
Functional specification overview	p. 173
Functional specification for core RBAC	p. 174
Functional specification for hierarchical RBAC	p. 176
Functional specification for static separation of duty (SSD) relation	p. 179
Functional specification for a DSD relation	p. 180
Options and packaging	p. 181
Other RBAC standards	p. 183
XACML profile for role-based access control	p. 185
References	p. 186
Role-Based Administration of RBAC	p. 189
Background and terminology	p. 189
URA02 and PRA02	p. 192
Crampton-Loizou administrative model	p. 196
Flexibility of administrative scope	p. 197
Decentralization and autonomy	p. 198
A family of models for hierarchical administration	p. 198
Role control center	p. 203
Inheritance and the role graph	p. 204
Constraints	p. 206
Role views	p. 206
Delegation of administrative permissions	p. 207
Decentralization and autonomy	p. 210
References	p. 212
Role Engineering	p. 213
Scenario-driven role-engineering approach	p. 215
Scenarios and roles	p. 216
Steps in the scenario-driven process	p. 217
Goal driven/hybrid role engineering approach	p. 220
Tools for role discovery and role management	p. 224
Sage DNA	p. 226
Role Miner	p. 227
SmartRoles	p. 228
Contouring Engine	p. 229
Example RBAC installations	p. 229
Role engineering: health care example	p. 232
Identify and model usage scenarios	p. 232
Derive permissions from scenarios	p. 234
Identify permission constraints	p. 236
Refine scenario model	p. 236
Additional process activities	p. 237
References	p. 237
Enterprise Access Control Frameworks Using RBAC and XML Technologies	p. 239
Conceptual view of EAFs	p. 239
Enterprise Access Central Model Requirements	p. 242
EAM's multiple-policy support requirement	p. 243
EAM's ease of administration requirement	p. 243
EAM specification and XML schemas	p. 244
Specification of the ERBAC model in the XML schema	p. 246
XML schema specifications for ERBAC model elements	p. 247
XML schema specifications for ERBAC model relations	p. 250
Encoding of enterprise access control data in XML	p. 253
Verification of the ERBAC model and data specifications	p. 257
Limitations of XML schemas for ERBAC model constraint representation	p. 258
Using XML-encoded enterprise access control data for enterprisewide access control implementation	p. 262
Conclusions	p. 268
References	p. 268
Integrating RBAC with Enterprise IT Infrastructures	p. 271
RBAC for WFMSs	p. 272
Workflow concepts and WFMSs	p. 272
WFMS components and access control requirements	p. 273
Access control design requirements	p. 274
RBAC model design and implementation requirements for WFMSs	p. 276
RBAC for workflows-research prototypes	p. 279
RBAC integration in Web environments	p. 280
Implementing RBAC entirely on the Web server	p. 281
Implementing RBAC for Web server access using cookies	p. 282
RBAC on the Web using attribute certificates	p. 284
RBAC for UNIX environments	p. 291
RBAC for UNIX administration	p. 291
RBAC implementation within the NFS	p. 296
RBAC in Java	p. 299
Evolution of Java security models	p. 300
JDK 1.2 security model and enhancement	p. 301
Incorporating RBAC into JDK 1.2 security model with JAAS	p. 304
RBAC for FDBSs	p. 306
IRO-DB architecture	p. 307
RBAC model implementation in IRO-DB	p. 308
RBAC in autonomous security service modules	p. 309
Conclusions	p. 311
References	p. 311
Migrating to RBAC-Case Study: Multiline Insurance Company	p. 315
Background	p. 316
Benefits of using RBAC to manage extranet users	p. 316
Simplifying systems administration and maintenance	p. 318
Enhancing organizational productivity	p. 319
Benefits of using RBAC to manage employees (intranet users)	p. 319
Reduction in new employee downtime	p. 319
Simplified systems administration and maintenance	p. 320
RBAC implementation costs	p. 320
Software and hardware expenses	p. 321
Systems administrators' labor expenses	p. 321
Role engineering expenses	p. 321
Time series of benefits and costs	p. 322
Reference	p. 324
RBAC Features in Commercial Products	p. 325
RBAC in relational DBMS products	p. 326
Informix Dynamic Server version 9.3 (IBM)	p. 327
Oracle Database 10g Release (10.2) (Oracle Corporation)	p. 329
Sybase Adaptive Server Enterprise 15.0 (Sybase)	p. 333
RBAC in enterprise security administration software	p. 340
CONTROL-SA (BMC software)	p. 342
DirX Identity V7.0 (Siemens)	p. 346
SAM Jupiter (Beta Systems)	p. 351
Tivoli Identity Manager version 1.1 (IBM)	p. 356
Conclusions	p. 359
References	p. 360
XML Schema for the RBAC Model	p. 361
XML-Encoded Data for RBAC Model	p. 365
About the Authors	p. 369
Index	p. 371
Table of Contents provided by Ingram. All Rights Reserved.

Please wait while the item is added to your bag...

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Role-based Access Control

Summary

Table of Contents

Supplemental Materials