RBAC• KHAN MOHAMMED ZEESHAN 65• SHAIKH ALIYA 76
CONTENTS• Access control principles• Mandatory Access Control (MAC)• Discretionary Access Control (DAC)• Role-based Access Control• Role-based Access Control Types
Access Control Principles• Computer-based access controls can prescribe not only who or what process may have access to a specific system resource, but also the type of access that is permitted.• Access control is not a stand alone component of a security system• Access control coexists with other security services• Access control works closely with audit control
Mandatory AC• MAC mechanisms assign a security level to all information, assign a security clearance to each user, and ensure that all users only have access to that data for which they have a clearance. Principle: Read Down Access equal or less Clearance Write Up Access equal or higher Clearance Better security than DAC
Mandatory AC (cont) Individuals Resources Server 1 “Top Secret” Server 2 “Secret” Server 3 “Classified”
Discretionary AC • Restricts access to objects based solely on the identity of users who are trying to access them.Individuals Resources Application Server 1 Access List Name Access Server 2 Tom Yes John No Cindy Yes Server 3
Role-Based AC• A user has access to an object based on the assigned role.• Roles are defined based on job functions.• Permissions are defined based on job authority and responsibilities within a job function.• Operations on an object are invocated based on the permissions.• The object is concerned with the user’s role and not the user. “Ideally, the [RBAC] system is clearly defined and agile, making the addition of new applications, roles, and employees as efficient as possible”
Role-Based ACIndividuals Roles Resources Role 1 Server 1 Role 2 Server 2 Server 3 Role 3 User’s change frequently, Roles don’t
Privilege• Roles are engineered based on the principle of least privileged• A role contains the minimum amount of permissions to instantiate an object.• A user is assigned to a role that allows him or her to perform only what’s required for that role.• No single role is given more permission than the same role for another user.
RBAC Reference Model• The NIST RBAC model is defined in terms of four model components . • Core RBAC • Hierarchical RBAC • Static Separation of Duty Relations • Dynamic Separation of Duty Relations
Core RBAC• It embodies the essential aspects of RBAC.• The basic concept of RBAC is that users are assigned to roles, and users acquire permissions by being members of roles.• Core RBAC includes requirements that user-role and permission-role assignment can be many-to-many.• It includes requirements for user-role review whereby the roles assigned to a specific user can be determined as well as users assigned to specific role. A similar requirement for permission-role review is imposed as an advanced review feature.• It allows includes the concept of user sessions, which allows selective activation and deactivation of roles.• Finally it requires that users be able to simultaneously exercise permission of multiple roles. This precludes products that restrict users of activation of one role at a time.
(UA) (PA) User Assign- Permission ment Assignment USERS ROLES OPS OBS PRMSuser_sessions session_roles SESSIONS Core RBAC
Hierarchical RBAC• It adds requirements for supporting role hierarchies. A hierarchy is mathematically a partial order defining a seniority relation between roles, whereby the seniors roles acquire the permission of their juniors, and junior roles acquire the user membership of their seniors. This standard recognizes two types of role hierarchies – General Hierarchical RBAC: In this case, there is support for an arbitrary partial order to serve as role hierarchy, to include the concept of multiple inheritance of permissions and user membership among roles. – Limited Hierarchical RBAC: Some systems may impose restrictions on the role hierarchy. Most commonly, hierarchies are limited to simple structures such as trees and inverted trees
RH (Role Hierarchies)• Natural means of structuring roles to reflect organizational lines of authority and responsibilities• General and Limited• Define the inheritance relation among roles i.e. r1 inherits r2 User Guest r-w-e -r-
General RH Support Multiple Guest Role Set Inheritance User Role Set Power User Role Set Admin Role Set Only if all permissions of r1 are also permissions of r2 i.e. r1 inherits r2Only if all users of r1 are also users of r2 User Guest r-w-h -r-
(RH) Role Hierarchy (UA) (PA) User Assign- Permission ment Assignment USERS ROLES OPS OBS PRMSuser_sessions session_roles SESSIONSHierarchical RBAC
Constrained RBAC SSD (RH) Role Hierarchy (UA) (PA) User Assign- Permission ment Assignment USERS ROLES OPS OBS PRMSuser_sessions session_roles SESSIONS DSD
Separation of Duties• Enforces conflict of interest policies employed to prevent users from exceeding a reasonable level of authority for their position.• Ensures that failures of omission or commission within an organization can be caused only as a result of collusion among individuals.• Two Types: – Static Separation of Duties (SSD) – Dynamic Separation of Duties (DSD)
Static Separation of Duty Relations• Enforce constraints on the assignment of users to roles• Place restrictions on sets of roles. If a user is assigned to one role, the user is prohibited from being a member of a second role.
Because of the conflict of role ‘billing’ and ‘Cashier’ , Frank is prohibited to be assigned both of them
DSD Places constraints on the users that can be assigned to a set of roles, thereby reducing the number of potential prms that can be made available to a user. Constraints are across or within a user’s session. No user may activate n or more roles from the roles set in each user session. Timely Revocation of Trust ensures that prms do not persist beyond the time that they are required for performance of duty.
DSD (cont) Roles inherits Cashier Supervisor Closes Cashier Role session Close Cash Drawer Opens Supv Role session Supervisor Cashier Open Cash DrawerAccounting Error Correct Error
Conclusion• RBAC is used to simplify security policy administration• RBAC is an open-ended technology,which ranges from very simple to fairly sophisticated.• RBAC continues to be an evolving technology.