Fine-grained access control with object-sensitive roles

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5653 LNCS, Issue , 2009, Pages 173-194

  Fischer, Jeffrey ^a   Marino, Daniel ^a   Majumdar, Rupak ^a   Millstein, Todd ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION CODES; BUSINESS OBJECTS; DEPENDENT TYPE SYSTEM; MEDICAL RECORD; OBJECT-ORIENTED LANGUAGES; ON DYNAMICS; PARAMETERIZED; RBAC MODEL; ROLE-BASED ACCESS CONTROL; SECURITY REQUIREMENTS; SYSTEM OPERATION; TYPE SYSTEMS;

ACCESS CONTROL; JAVA PROGRAMMING LANGUAGE; SECURITY SYSTEMS;

OBJECT ORIENTED PROGRAMMING;

EID: 69949172480     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-03013-0_9     Document Type: Conference Paper

References (30)

1. Abdallah, A.E., Khayat, E.J.: A formal model for parameterized role-based access control. In: Dimitrakos, T., Martinelli, F. (eds.) Formal Aspects in Security and Trust, pp. 233-246. Springer, Heidelberg (2004)
2. Andreae, C., Noble, J., Markstrum, S., Millstein, T.: A framework for implementing pluggable type systems. In: OOPSLA 2006: Proceedings of the 21st annual ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages, and Applications, pp. 57-74. ACM Press, New York (2006)
3. Barkley, J., Beznosov, K., Uppal, J.: Supporting relationships in access control using role based access control. In: RBAC 1999: Proceedings of the fourth ACM workshop on Role-based access control, pp. 55-65. ACM, New York (1999)
4. Barth, A., Mitchell, J., Datta, A., Sundaram, S.: Privacy and utility in business processes. In: CSF 2007, pp. 279-294. IEEE Computer Society Press, Los Alamitos (2007)
5. Becker, M.: Information governance in nhs's npfit: A case for policy specification. International Journal of Medical Informatics (IJMI) 76(5-6) (2007)
6. Becker, M., Sewell, P.: Cassandra: Distributed access control policies with tunable expressiveness. In: POLICY 2004, pp. 159-168 (2004)
7. Clarke, D.G., Potter, J.M., Noble, J.: Ownership types for flexible alias protection. In: Proceedings of the 13th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, pp. 48-64. ACM Press, New York (1998)
8. eXtensible Access Control Markup Language (XACML) Version 2.03. OASIS Standard (February 2005)
9. Ferraiolo, D., Kuhn, R.: Role-based access control. In: 15th National Computer Security Conference (1992)
10. Fischer, J., Marino, D., Majumdar, R., Millstein, T.: Fine-grained access control with objectsensitive roles. Technical Report CSD-TR-090010, UCLA Comp. Sci. Dept. (2009)
11. Gifford, D.K., Lucassen, J.M.: Integrating functional and imperative programming. In: LFP 1986: Proceedings of the 1986 ACM Conference on LISP and Functional Programming, pp. 28-38. ACM Press, New York (1986)
12. Giuri, L., Iglio, P.: Role templates for content-based access control. In: RBAC 1997: Proceedings of the second ACM workshop on Role-based access control, pp. 153-159. ACM Press, New York (1997)
13. Hibernate home page, http://www.hibernate.org
14. Igarashi, A., Pierce, B.C., Wadler, P.: Featherweight Java: a minimal core calculus for Java and GJ. ACM Transactions on Programming Languages and Systems 23(3), 396-450 (2001)
15. Jaeger, T., Michailidis, T., Rada, R.: Access control in a virtual university. In: WETICE 1999: Proceedings of the 8th Workshop on Enabling Technologies on Infrastructure for Collaborative Enterprises, Washington, DC, USA, pp. 135-140. IEEE Computer Society Press, Los Alamitos (1999)
16. Java Platform, Enterprise Edition home page, http://java.sun.com/javaee
17. Markstrum, S., Marino, D., Esquivel, M., Millstein, T.: Practical enforcement and testing of pluggable type systems. Technical Report CSD-TR-080013, UCLA Comp. Sci. Dept. (2008)
18. Martin-Löf, P.: Constructive mathematics and computer programming. In: Sixth International Congress for Logic, Methodology, and Philosophy of Science, pp. 153-175. North-Holland, Amsterdam (1982)
19. Nystrom, N., Saraswat, V., Palsberg, J., Grothoff, C.: Constrained types for object-oriented languages. In: OOPSLA 2008: Proceedings of the 23rd ACM SIGPLAN Conference on Object Oriented Programming Systems Languages and Applications, pp. 457-474. ACM Press, New York (2008)
20. Olson, L., Gunter, C., Madhusudan, P.: A formal framework for reflective database access control policies. In: CCS 2008: Proceedings of the 15th ACM conference on Computer and communications security, pp. 289-298. ACM Press, New York (2008)
21. OpenMRS home page, http://openmrs.org
22. g Virtual Private Database (2009), http://www.oracle.com/technology/deploy/security/database-security/ virtual-private-database/index.html
23. Pandey, R., Hashii, B.: Providing fine-grained access control for Java programs. In: Guerraoui, R. (ed.) ECOOP 1999. LNCS, vol. 1628, pp. 668-692. Springer, Heidelberg (1999)
24. Pierce, B.C.: Types and Programming Languages. The MIT Press, Cambridge (2002)
25. Pistoia, M., Fink, S., Flynn, R., Yahav, E.: When role models have flaws: Static validation of enterprise security policies. In: ICSE 2007, pp. 478-488. IEEE, Los Alamitos (2007)
26. Rizvi, S., Mendelzon, A., Sudarshan, S., Roy, P.: Extending query rewriting techniques for fine-grained access control. In: SIGMOD 2004: Proceedings of the 2004 ACM SIGMOD international conference on Management of data, pp. 551-562. ACM Press, New York (2004)
27. Sandhu, R., Coyne, E., Feinstein, H., Youman, C.: Role-based access control models. IEEE Computer 29(2), 38-47 (1996)
28. Spring Application Framework home page, http://www.springsource.org
29. Walker, D., Crary, K., Morrisett, G.: Typed memory management via static capabilities. ACM Trans. Program. Lang. Syst. 22(4), 701-771 (2000)
30. Wright, A.K., Felleisen, M.: A syntactic approach to type soundness. Information and Computation 115(1), 38-94 (1994)