GROUP HIERARCHIES WITH DECENTRALIZED USER ASSIGNMENT IN WINDOWS NT RAVI SANDHU and GAIL-JOON AHN
نویسنده
چکیده
The notion of groups in Windows NT is much like that in other operating systems. Rather than set user and le rights individually for each and every user, the administrator can give rights to various groups, then place users within those groups. In this paper we describe an experiment to extend the Windows NT group mechanism in two signi cant ways that are useful in managing group-based access control in large-scale systems. The goal of our experiment is to demonstrate how group hierarchies (where groups include other groups) and decentralized user-group assignment (where administrators are selectively delegated authority to assign certain users to certain groups) can be implemented by means of Microsoft remote procedure call (RPC) programs. In both respects the experimental goal is to implement previously published models (RBAC96 for group hierarchies and URA97 for decentralized usergroup assignment). Our results indicate that Windows NT has adequate exibility to accommodate sophisticated access control models to some extent.
منابع مشابه
Decentralized user group assignment in Windows NT
The notion of groups in Windows NT is much like that in other operating systems. Rather than set user and ®le rights individually for each and every user, the administrator can give rights to various groups, then place users within those groups. Each user within a group inherits the rights associated with that group. In this paper, we describe an experiment to extend the Windows NT group mechan...
متن کاملGroup Hierarchies with Constrained User Assignment in Linux
In this paper we investigate one aspect of RBAC administration concerning assignment of users to roles. A user-role assignment model can also be used for managing user-group assignment. We overview a constrained user-group assignment model and describe its implementation in the Linux system. Rather than set user and file rights individually for each and every user, the administrator can give ri...
متن کاملCONUGA: Constrained User-Group Assignment
In role-based access control (RBAC), permissions are associated with roles and users are made members of appropriate roles, thereby acquiring the roles’ permissions. The principal motivation behind RBAC is to simplify administration. In this paper, we investigate one aspect of RBAC administration concerning assignment of users to roles. We introduce a constrained user-role assignment model, cal...
متن کاملDecentralized Group Hierarchies in UNIX: An Experiment and Lessons Learned
Unix includes a simple group mechanism for access control. In this paper we describe an experiment to extend this mechanism in two signi cant ways that are valuable in managing group-based access control in large-scale systems. The goal of our experiment is to demonstrate how group hierarchies (where groups include other groups) and decentralized user-group assignment (where administrators are ...
متن کاملRole-based Access Control on the Web Using LDAP
This paper gives a framework for how to leverage Lightweight Directory Access Protocol (LDAP) to implement Role-based Access Control (RBAC) on the Web in the server-pull architecture. LDAP-based directory services have recently received much attention because they can support object-oriented hierarchies of entries in which we can easily search and modify attributes over TCP/IP. To implement RBA...
متن کامل