Role-Based Access Control Corban Rivera CS 6204, Spring 2005 1 - - PowerPoint PPT Presentation

1 CS 6204, Spring 2005

Role-Based Access Control

Corban Rivera

2 CS 6204, Spring 2005

Trusted Computer System Evaluation Criteria (TCSEC) Background

♦ MAC – Mandatory Access Control

– Firm security levels

♦ DAC – Discretionary Access Control

– Access can be delegated

3 CS 6204, Spring 2005

Role Based Access Control

♦ Access is role (job) specific

– Roles are intrinsically part of organizations

4 CS 6204, Spring 2005

RBAC Supports

♦ Simplified Administration

– Predefined roles change slowly

♦ Least Privilege

– Roles are given least amount of privilege to complete assigned tasks

♦ Separation of Duties

– Mutually exclusive roles

♦ Data Abstraction

– Abstract privilages

5 CS 6204, Spring 2005

Relationship types in RBAC

♦ between roles

– inheritance

♦ Between users and

roles

♦ Between roles and

permissions

6 CS 6204, Spring 2005

Additional Features

♦ Role membership cardinality constraints

– Enforce a maximum number of members in a role

♦ Prerequisite roles

– Role access granted because of membership in prerequisite roles

♦ Administrative RBAC

– RBAC can be used to give privileges to RBAC administrators