Security analysis for temporal role based access control

Abstract

Providing restrictive and secure access to resources is a challenging and socially important problem. Among the many formal security models, Role Based Access Control (RBAC) has become the norm in many of today's organizations for enforcing security. For every model, it is necessary to analyze and prove that the corresponding system is secure. Such analysis helps understand the implications of security policies and helps organizations gain confidence on the control they have on resources while providing access, and devise and maintain policies. In this paper, we consider security analysis for the Temporal RBAC (TRBAC), one of the extensions of RBAC. The TRBAC considered in this paper allows temporal restrictions on roles themselves, user-permission assignments (UA), permission-role assignments (PA), as well as role hierarchies (RH). Towards this end, we first propose a suitable administrative model that governs changes to temporal policies. Then we propose our security analysis strategy, that essentially decomposes the temporal security analysis problem into smaller and more manageable RBAC security analysis sub-problems for which the existing RBAC security analysis tools can be employed. We then evaluate them from a practical perspective by evaluating their performance using simulated data sets.

Cite this paper

@article{uzun2014security,
  title = {{Security analysis for temporal role based access control}},
  author = {Uzun, Emre and Atluri, Vijayalakshmi and Vaidya, Jaideep and Sural, Shamik and Ferrara, Anna Lisa and Parlato, Gennaro and Madhusudan, P.},
  journal = {Journal of Computer Security},
  volume = {22},
  number = {6},
  pages = {961--996},
  year = {2014},
  doi = {10.3233/jcs-140510}
}

Made from the index record. Check names, capitalisation and page numbers against the paper. Need another style? AI for Research has over 10,000.

Related papers