A framework for verification and optimal reconfiguration of event-driven role based access control policies
Abstract
Role based access control (RBAC) is the de facto model used for advanced access control due to its inherent richness and flexibility. Despite its great success at modeling a variety of organizational needs, maintaining large complex policies is a challenging problem. Conflicts within policies can expose the underlying system to numerous vulnerabilities and security risks. Therefore, more comprehensive verification tools for RBAC need to be developed to enable effective access control. In this paper, we propose a verification framework for detection and resolution of inconsistencies and conflicts in policies modeled through event-driven RBAC, an important subset of generalized temporal RBAC applicable to many domains, such as SCADA systems. We define the conflict resolution problem and propose an integer programming based heuristic. The proposed approach is generic and can be tuned to a variety of optimality measures.
Keywords
security and privacty, systems security, access control, operating system security
Date of this Version
2012
DOI
10.1145/2295136.2295172
Comments
SACMAT '12 Proceedings of the 17th ACM symposium on Access Control Models and Technologies
Pages 197-208