Published in

Proceedings of the 2nd ACM symposium on Information, computer and communications security - ASIACCS '07

DOI: 10.1145/1229285.1229335

Links

Tools

Export citation

Search in Google Scholar

Extended privilege inheritance in RBAC

Proceedings article published in 2007 by Mac Marnix Dekker, M. A. C. Dekker, Jg G. Cederquist, Jason Crampton, Sandro Etalle
This paper is available in a repository.
This paper is available in a repository.

Full text: Download

Green circle
Preprint: archiving allowed
Upload
Green circle
Postprint: archiving allowed
Upload
Red circle
Published version: archiving forbidden
Policy details
Data provided by SHERPA/RoMEO

Abstract

In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor.