A theory for comparing the expressive power of access control models

نویسندگان

  • Mahesh V. Tripunitara
  • Ninghui Li
چکیده

Comparing the expressive power of access control models is recognized as a fundamental problem in computer security. While such comparisons are generally based on simulations between different access control schemes, the definitions for simulations that are used in the literature are informal, and make it impossible to put results and claims about the expressive power of access control models into a single context. Furthermore, some definitions for simulations used in the literature such as those used for comparing RBAC (Role-Based Access Control) with other models, are too weak to distinguish access control models from one another in a meaningful way. We propose a theory for comparing the expressive power of access control models. We perceive access control systems as state-transition systems and require simulations to preserve security properties. We discuss the rationale behind such a theory, apply the theory to reexamine some existing work on the expressive power of access control models in the literature, and present four results. We show that: (1) the well known HRU scheme is limited in its expressive power when compared to a rather simple trust-management scheme, thereby formally establishing a conjecture from the literature; (2) RBAC with a particular administrative scheme from the literature (ARBAC97) is limited in its expressive power, countering claims in the literature that RBAC is more expressive than DAC (Discretionary Access Control) schemes; (3) the ability to check for the absence of rights (in addition to the presence of rights) causes ATAM (Augmented Typed Access Matrix) to be more expressive than TAM (Typed Access Matrix); and (4) a trust-management scheme is at least as expressive as RBAC with a particular administrative scheme (the URA97 component of ARBAC97).

برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید

ثبت نام

اگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید

منابع مشابه

CERIAS Tech Report 2005-83 A THEORY BASED ON SECURITY ANALYSIS FOR COMPARING THE EXPRESSIVE POWER OF ACCESS CONTROL MODELS

Tripunitara, Mahesh V. Ph.D., Purdue University, December, 2005. A Theory Based on Security Analysis for Comparing the Expressive Power of Access Control Models. Major Professor: Ninghui Li. We present a theory for comparing the expressive power of access control models. Our theory is based on reductions that preserve the results of security analysis. Security analysis is an approach to the ver...

متن کامل

A theory for comparing the expressive power of access control models 1

We present a theory for comparing the expressive power of access control models. The theory is based on simulations that preserve security properties. We perceive access control systems as state-transition systems and present two kinds of simulations, reductions and state-matching reductions. In applying the theory, we highlight four new results and discuss these results in the context of other...

متن کامل

Equivalence of Group-Centric Collaboration with Expedient Insiders (GEI) and LBAC with Collaborative Compartments (LCC)

Equivalence of access control models can be proved by comparing their expressive power. Tripunitara and Li [3] have given a generalized theoretical formulation for comparing expressive power of access control models via simulations that preserve security properties which are called state matching reductions. This report gives a formal proof of a state matching reduction from Group-Centric Colla...

متن کامل

A semantic-aware role-based access control model for pervasive computing environments

Access control in open and dynamic Pervasive Computing Environments (PCEs) is a very complex mechanism and encompasses various new requirements. In fact, in such environments, context information should be used in access control decision process; however, it is not applicable to gather all context information completely and accurately all the time. Thus, a suitable access control model for PCEs...

متن کامل

Comparison of the Expressive Power of Language-Based Access Control Models

This paper compares the expressive power of five languagebased access control models. We show that the expressive powers are incomparable between any pair of history-based access control, regular stack inspection and shallow history automata. Based on these results, we introduce an extension of HBAC, of which expressive power exceeds that of regular stack inspection.

متن کامل

ذخیره در منابع من


  با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید

برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید

ثبت نام

اگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید

عنوان ژورنال:
  • Journal of Computer Security

دوره 15  شماره 

صفحات  -

تاریخ انتشار 2007