Applying Fuzzy Relations in Role-Based Access Control

Current computer security systems are based on the premise that once a user presents valid credentials to the authentication system (e.g. valid ID and password), they are granted access permission to all resources assigned to the user that they claim to be. However, numerous studies have shown that most security breaches are done by unauthorized users impersonating as authorized users (e.g. by cracking or stealing passwords) or by circumventing the authentication system altogether (by exploiting security “holes” in the system). Once the authentication system is broken, the system and the information kept in it become wide open to unauthorized access and malicious usage.. In this paper, we plan to first investigate the applicability of fuzzy approach to RBAC by identifying access control requirements that are inherently fuzzy in organizational contexts. Then we propose to develop a Fuzzy-RBAC (F-RBAC) model by extending an existing RBAC model with fuzzy parameters to allow imprecise access control policies.