Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies

ACM Transactions on Information and System Security

Volumn 3, Issue 2, 2000, Pages 85-106

  Osborn, Sylvia ^a   Sandhu, Ravi ^b   Munawer, Qamar ^b  

^a UNIVERSITY OF WESTERN ONTARIO   (Canada)

^b George Mason University   (United States)

Author keywords

discretionary access control; lattice based access control; Management; mandatory access control; Role based access control; Security

Indexed keywords

EID: 84884311106     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/354876.354878     Document Type: Article

References (20)

1. Bell, D. 1987. Secure computer systems: A network interpretation. In Proceedings on 3rd Annual Computer Security Application Conference. 32-39
2. Clark, D. and Wilson, D. 1987. A comparison of commercial and military computer security policies. In Proceedings of IEEE Symposium on Security and Privacy (Oakland, CA, May). 184-194
3. Denning, D. E. 1976. A lattice model of secure information flow. Commun. ACM 19, 2, 236-243
4. Graham, G. and Denning, P. 1972. Protection-principles and practice. In Proceedings on AFIPS Spring Joint Computer Conference. AFIPS Press, Arlington, VA, 417-429
5. Lampson, B. 1974. Protection. In Proceedings of the 5th Symposium on Information Sciences and Systems (Princeton, NJ, Mar.). 437-443
6. Lee, T. 1988. Using mandatory integrity to enforce “commercial” security. In Proceedings of IEEE Symposium on Security and Privacy (Oakland, CA). 140-146
7. Munawer, Q. 2000. Administrative models for role-based access control. Ph.D. Dissertation
8. Nyanchama, M. and Osborn, S. 1994. Access rights administration in role-based security systems. In Proceedings of the IFIP Working Group 11.3 Working Conference on Database Security. Elsevier North-Holland, Inc., Amsterdam, The Netherlands, 37-56
9. Nyanchama, M. and Osborn, S. 1996. Modeling mandatory access control in role-based security systems. In Database Security VIII: Status and Prospects. Chapman and Hall, Ltd., London, UK, 129-144
10. Nyanchama, M. and Osborn, S. 1999. The role graph model and conflict of interest. ACM Trans. Inf. Syst. Secur. 1, 2 (Feb.), 3-33
11. Osborn, S. 1997. Mandatory access control and role-based access control revisited. In Proceedings of the Second ACM Workshop on Role-based Access Control (RBAC '97, Fairfax, VA, Nov. 6-7), C. Youman, E. Coyne, and T. Jaeger, Chairs. ACM Press, New York, NY, 31-40
12. Osborn, S., Reid, L. K., and Wesson, G. J. 1997. On the interaction between role-based access control and relational databases. In Proceedings of the Tenth Annual IFIP TC11/ WG11.3 International Conference on Database Security: Volume X: Status and Prospects (Como, Italy, July 22-24, 1996), P. Samarati and R. S. Sandhu, Eds. Chapman and Hall, Ltd., London, UK, 275-287
13. Sandhu, R. S. 1993. Lattice-based access control models. IEEE Computer 26, 11, 9-19
14. Sandhu, R. 1996. Role hierarchies and constraints for lattice-based access controls. In Proceedings of the Conference on Computer Security (ESORICS 96, Rome, Italy), E. Bertino, H. Kurth, G. Martella, and E. Montolivo, Eds. Springer-Verlag, New York, NY, 65-79
15. Sandhu, R. S., Bhamidipati, V., and Munawer, Q. 1999. The ARBAC97 model for role-based administration of roles. ACM Trans. Inf. Syst. Secur. 1, 2 (Feb.), 105-135
16. Sandhu, R. S., Coyne, E. J., Feinstein, H. L., and Youman, C. E. 1996. Role-based access control models. IEEE Computer 29, 2 (Feb.), 38-47
17. Sandhu, R. and Munawer, Q. 1998. How to do discretionary access control using roles. In Proceedings of the Third ACM Workshop on Role-Based Access Control (RBAC '98, Fairfax, VA, Oct. 22-23), C. Youman and T. Jaeger, Chairs. ACM Press, New York, NY, 47-54
18. Sandhu, R. and Samarati, P. 1994. Access control: Principles and practice. IEEE Commun. Mag. 32, 9, 40-48
19. Sandhu, R. S. and Samarati, P. 1997. Authentication, access control and intrusion detection. In The Computer Science and Engineering Handbook, A. B. Tucker, Ed. CRC Press, Inc., Boca Raton, FL, 1929-1948
20. Schockley, W. 1988. Implementing the Clark/Wilson integrity policy using current technology. In Proceedings of the 11th National Computer Security Conference (NIST-NCSC, Baltimore, Maryland, Oct.17-20). National Institute of Standards and Technology, Gaithersburg, MD, 29-37