Delegation in Role-Based Access Control Controlling delegation - - PowerPoint PPT Presentation

▶
delegation in role based access control
SMART_READER_LITE
LIVE PREVIEW

Delegation in Role-Based Access Control Controlling delegation - - PowerPoint PPT Presentation

Apr 06, 2024 376 likes •961 views

Introduction Delegation operations in hierarchical RBAC Delegation in Role-Based Access Control Controlling delegation Enforcing transfer delegation Jason Crampton Hemanth Khambhammettu semantics Conclusion Information Security

slide-1
SLIDE 1

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation in Role-Based Access Control

Jason Crampton · Hemanth Khambhammettu

Information Security Group, Royal Holloway, University of London

ESORICS · Hamburg · 2006

slide-2
SLIDE 2

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Outline

1

Introduction

2

Delegation operations in hierarchical RBAC

3

Controlling delegation

4

Enforcing transfer delegation semantics

5

Conclusion

slide-3
SLIDE 3

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation

Delegation is a lightweight method for assigning temporary permissions to a user A delegator is required to be authorized for the delegated permission

slide-4
SLIDE 4

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation

Delegation is a lightweight method for assigning temporary permissions to a user A delegator is required to be authorized for the delegated permission Administration is a general term for the methods by which an authorization policy can be updated (including authorizing a user for a permission) An administrator is not necessarily required to be authorized for the permission

slide-5
SLIDE 5

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations

Grant A delegator may grant a permission p to a delegatee The delegator is still authorized for p Monotonic

slide-6
SLIDE 6

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations

Grant A delegator may grant a permission p to a delegatee The delegator is still authorized for p Monotonic Transfer A delegator may transfer p The delegator is no longer authorized for p Non-monotonic

slide-7
SLIDE 7

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Role hierarchy A partially ordered set of roles (R, )

slide-8
SLIDE 8

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Role hierarchy A partially ordered set of roles (R, ) User-role assignment relation UA ⊆ U × R

slide-9
SLIDE 9

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Role hierarchy A partially ordered set of roles (R, ) User-role assignment relation UA ⊆ U × R Permission-role assignment relation PA ⊆ P × R

slide-10
SLIDE 10

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Authorized roles u is authorized for role r′ if there exists r r′ and (u, r) ∈ UA

slide-11
SLIDE 11

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Authorized roles u is authorized for role r′ if there exists r r′ and (u, r) ∈ UA Authorized permissions u is authorized for permission p if there exists a role r for which u is authorized and (p, r) ∈ PA

slide-12
SLIDE 12

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Sessions u creates a session by activating some subset of the roles for which she is authorized

slide-13
SLIDE 13

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Role-based access control

Sessions u creates a session by activating some subset of the roles for which she is authorized Authorized requests A request by u for permission p is granted if u has activated a role r such that (p, r) ∈ PA

slide-14
SLIDE 14

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Motivation

Delegation in RBAC has focused on delegation of roles (interpreted as a set of permissions)

slide-15
SLIDE 15

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Motivation

Delegation in RBAC has focused on delegation of roles (interpreted as a set of permissions) Existing models for delegation in RBAC only consider grant

  • perations

The existence of the hierarchy makes enforcing transfer

  • perations difficult
slide-16
SLIDE 16

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Motivation

Delegation in RBAC has focused on delegation of roles (interpreted as a set of permissions) Existing models for delegation in RBAC only consider grant

  • perations

The existence of the hierarchy makes enforcing transfer

  • perations difficult

Existing models for delegation are simplistic and lack controls

  • n the propagation of permissions and roles
slide-17
SLIDE 17

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

1

Introduction

2

Delegation operations in hierarchical RBAC

3

Controlling delegation

4

Enforcing transfer delegation semantics

5

Conclusion

slide-18
SLIDE 18

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

grantRole(u, v, d) Delegator u grants role d to delegatee v

a c f h e b d g

slide-19
SLIDE 19

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

grantRole(u, v, d) Delegator u grants role d to delegatee v u continues to be authorized for all roles in ↓d

a c f h e b d g

slide-20
SLIDE 20

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleStrong(u, v, d) Delegator u transfers role d to delegatee v

a c f h e b d g

slide-21
SLIDE 21

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleStrong(u, v, d) Delegator u transfers role d to delegatee v u is no longer authorized for any role in ↓d

a c f h e b d g

slide-22
SLIDE 22

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleStatic(u, v, d) Delegator u transfers role d to delegatee v

a c f h e b d g

slide-23
SLIDE 23

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleStatic(u, v, d) Delegator u transfers role d to delegatee v u is no longer authorized for any role x ∈ ↓d unless there exists r = d such that r x and (u, r) ∈ UA

a c f h e b d g

slide-24
SLIDE 24

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleDynamic(u, v, d) Delegator u transfers role d to delegatee v

a c f h e b d g

slide-25
SLIDE 25

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Delegation operations and their semantics

transferRoleDynamic(u, v, d) Delegator u transfers role d to delegatee v u is no longer authorized for any role x ∈ ↓d unless u has activated a role r = d such that r x

a c f h e b d g a c f h e b d g

slide-26
SLIDE 26

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Administrative scope

Fundamental concept in the RHA family of administrative models Maps a role r to a set of roles σ(r) σ(r) = {r′ r : ↑r′ ⊆ ↓r ∪ ↑r} If r′ ∈ σ(r), every path upwards from r′ passes through r

slide-27
SLIDE 27

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Administrative scope

Fundamental concept in the RHA family of administrative models Maps a role r to a set of roles σ(r) σ(r) = {r′ r : ↑r′ ⊆ ↓r ∪ ↑r} If r′ ∈ σ(r), every path upwards from r′ passes through r σ(a) = {a, b, . . . , h} σ(b) = {b, d} σ(d) = {d}

a c f h e b d g

slide-28
SLIDE 28

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Administrative scope and delegation operations

It can be shown that the set of roles denied by a static transfer of r is σ(r) by a dynamic transfer of r is σ(r), where σ is evaluated in the sub-poset of R generated by the set of activated roles

slide-29
SLIDE 29

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

1

Introduction

2

Delegation operations in hierarchical RBAC

3

Controlling delegation

4

Enforcing transfer delegation semantics

5

Conclusion

slide-30
SLIDE 30

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Should a delegation request be granted?

A delegator u makes a request to delegate role r to delegatee v

slide-31
SLIDE 31

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Should a delegation request be granted?

A delegator u makes a request to delegate role r to delegatee v Is the delegator authorized to delegate a role or permission that is available to him?

slide-32
SLIDE 32

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Should a delegation request be granted?

A delegator u makes a request to delegate role r to delegatee v Is the delegator authorized to delegate a role or permission that is available to him? Should the delegatee receive the delegated role or permission?

slide-33
SLIDE 33

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Should a delegation request be granted?

A delegator u makes a request to delegate role r to delegatee v Is the delegator authorized to delegate a role or permission that is available to him? Should the delegatee receive the delegated role or permission?

slide-34
SLIDE 34

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using delegation relations

can-delegate ⊆ R × R (r, r′) ∈ can-delegate means that u can delegate role r′ if she has activated role r For all (r, r′) ∈ can-delegate we require r r′

slide-35
SLIDE 35

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using delegation relations

can-delegate ⊆ R × R (r, r′) ∈ can-delegate means that u can delegate role r′ if she has activated role r For all (r, r′) ∈ can-delegate we require r r′ can-receive ⊆ R × 2R (r, C) ∈ can-receive means that v can receive role r if she is assigned to all roles in C Optionally, we may require that for all (r, C) ∈ can-receive and for all r′ ∈ C, r r′

slide-36
SLIDE 36

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

The administrative scope of a session s is defined to be

  • r∈s

σ(r)

slide-37
SLIDE 37

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

The administrative scope of a session s is defined to be

  • r∈s

σ(r) A user u running session s may delegate r′ if r′ ∈ σ(s) u may delegate any role she controls (as defined by σ)

slide-38
SLIDE 38

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

The administrative scope of a session s is defined to be

  • r∈s

σ(r) A user u running session s may delegate r′ if r′ ∈ σ(s) u may delegate any role she controls (as defined by σ) A user v may receive the delegation of role r′ from user u if for all r < r′ such that r ∈ σ(s), v is authorized for r u may not (indirectly) authorize v (via the delegation of r) for any roles that u does not control

slide-39
SLIDE 39

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

A user u who has activated b can delegate role d because d ∈ σ(b)

a c f h e b d g

slide-40
SLIDE 40

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

A user u who has activated b can delegate role d because d ∈ σ(b) A request by u to delegate d to a user v who is already assigned to g will be granted

a c f h e b d g

slide-41
SLIDE 41

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Using administrative scope

A user u who has activated b can delegate role d because d ∈ σ(b) A request by u to delegate d to a user v who is already assigned to g will be granted A request by u to delegate d to a user w who is only assigned to h will be denied

a c f h e b d g

slide-42
SLIDE 42

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Comparison

Relation-based approach Very similar to ARBAC97 (Sandhu et al) and a number of delegation models related to ARBAC97 The novelty of our approach is to separate the conditions

  • n giving and receiving delegated roles

This provides greater modularity and ease of management

slide-43
SLIDE 43

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Comparison

Relation-based approach Very similar to ARBAC97 (Sandhu et al) and a number of delegation models related to ARBAC97 The novelty of our approach is to separate the conditions

  • n giving and receiving delegated roles

This provides greater modularity and ease of management The increase in power of a delegatee is determined by the configuration of can-receive Changes to the role hierarchy may “break” the delegation relations

slide-44
SLIDE 44

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Comparison

Administrative scope-based approach Very similar to RHA family of administrative models (Crampton and Loizou) Delegation is controlled by the shape of the hierarchy and the delegator’s own capabilities

slide-45
SLIDE 45

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Comparison

Administrative scope-based approach Very similar to RHA family of administrative models (Crampton and Loizou) Delegation is controlled by the shape of the hierarchy and the delegator’s own capabilities The increase in power of a delegatee is limited by the power of the delegator It is not fragile with respect to changes in the hierarchy

slide-46
SLIDE 46

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

1

Introduction

2

Delegation operations in hierarchical RBAC

3

Controlling delegation

4

Enforcing transfer delegation semantics

5

Conclusion

slide-47
SLIDE 47

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Recording delegations

The delegation history relation DH records all successful delegation requests Contains a unique identifier, the delegator, the delegatee, the delegated role, and a delegation mask

slide-48
SLIDE 48

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Recording delegations

The delegation history relation DH records all successful delegation requests Contains a unique identifier, the delegator, the delegatee, the delegated role, and a delegation mask The tempUA relation records all user-role assignments that arise from delegation operations (i, u, r, +) ∈ tempUA means that u (as a delegatee) is assigned to r (as a result of delegation operation with identifier i) (i, u, r, −) ∈ tempUA means that u (as a delegator) is no longer assigned to r (as a result of a transfer operation)

slide-49
SLIDE 49

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Examples

transferRoleStrong(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ r}

slide-50
SLIDE 50

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Examples

transferRoleStrong(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ r} transferRoleStatic(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ ∈ σ(u, ↓R(u))}

slide-51
SLIDE 51

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Examples

transferRoleStrong(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ r} transferRoleStatic(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ ∈ σ(u, ↓R(u))} transferRoleDynamic(u, v, r) tempUA ← tempUA ∪ {(i, v, r, +)} ∪ {(i, u, r′, −) : r′ ∈ σ(u, ↓s(u))}

slide-52
SLIDE 52

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Deciding access requests

Authorized roles A user u is authorized for role r′ if there exists r r′ and (u, r) ∈ UA and there does not exist a tuple (i, u, r′, −) ∈ tempUA

slide-53
SLIDE 53

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Deciding access requests

Authorized roles A user u is authorized for role r′ if there exists r r′ and (u, r) ∈ UA and there does not exist a tuple (i, u, r′, −) ∈ tempUA Authorized permissions u is authorized for permission p if there exists a role r for which u is authorized and (p, r) ∈ PA and there does not exist a tuple (i, u, p, −) ∈ tempPA

slide-54
SLIDE 54

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

1

Introduction

2

Delegation operations in hierarchical RBAC

3

Controlling delegation

4

Enforcing transfer delegation semantics

5

Conclusion

slide-55
SLIDE 55

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Contributions and related work

Characteristic RBDM0 RDM2000 PBDM Our model Role delegation ✓ ✓ ✓ ✓ Permission delegation ✗ ✗ ✓ ✓ Grant delegation ✓ ✓ ✓ ✓ Transfer delegation ✗ ✗ ✗ ✓ Controlling delegations ✓ ✓ ✓ ✓ Implicit updates ✗ ✗ ✗ ✓ Delegation history ✗ ✓ ✗ ✓ Temporary assignments ✓ ✓ ✓ ✓ Revocation ✓ ✓ ✓ ✓

slide-56
SLIDE 56

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Future work

Develop a model and operational semantics for revocation Investigate the use of our delegation model in workflow systems Investigate the synthesis of existing delegation and administrative models

slide-57
SLIDE 57

Introduction Delegation

  • perations in

hierarchical RBAC Controlling delegation Enforcing transfer delegation semantics Conclusion

Questions