1. © 2004 Ravi Sandhu www.list.gmu.edu Role-Based Access Control Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University www.list.gmu.edu sandhu@gmu.edu

2. © 2004 Ravi Sandhu www.list.gmu.edu Access Control Models: A perspective

3. © 2004 Ravi Sandhu www.list.gmu.edu 3 Access Matrix Model (Lampson 1971) U r w V F SubjectsSubjects Objects (and Subjects) r w G r rights

4. © 2004 Ravi Sandhu www.list.gmu.edu 4 Access Matrix Model Separates authentication from authorization Rights are persistent These items have come into question in recent times, but that is a topic for another talk. Separates model from implementation Policy versus mechanism This separation continues to be valuable and will be discussed and refined later in this talk.

5. © 2004 Ravi Sandhu www.list.gmu.edu 5 MAC, DAC and RBAC For 25 years (1971-96) access control was divided into Mandatory Access Control (MAC) Discretionary Access Control (DAC) Since the early-mid 1990s Role-Based Access Control (RBAC) has become a dominant force RBAC subsumes MAC and DAC RBAC is not the final answer BUT is a critical piece of the final answer

6. © 2004 Ravi Sandhu www.list.gmu.edu 6 Mandatory Access Control (MAC) TS S C U Information Flow Dominance Lattice of security labels Rights are determined by security labels (Bell-LaPadula 1971)

7. © 2004 Ravi Sandhu www.list.gmu.edu 7 Mandatory Access Control (MAC) U r w V F SubjectsSubjects Objects (and Subjects) r w G r security label of F must dominate or equal security label of G

8. © 2004 Ravi Sandhu www.list.gmu.edu 8 Discretionary Access Control (DAC) The owner of a resource determines access to that resource The owner is often the creator of the resource Fails to distinguish read from copy This distinction has re-emerged recently under the name Dissemination Control (DCON)

9. © 2004 Ravi Sandhu www.list.gmu.edu 9 Discretionary Access Control (DAC) U r w V F SubjectsSubjects Objects (and Subjects) r w G r

10. © 2004 Ravi Sandhu www.list.gmu.edu 10 Discretionary Access Control (DAC) U r w own V F SubjectsSubjects Objects (and Subjects) r w own G r Rights are determined by the owners

11. © 2004 Ravi Sandhu www.list.gmu.edu 11 Beyond DAC and MAC Many attempts were made Domain-Type enforcement (Boebert-Kain 1985) Clark-Wilson (1987) Chinese Walls (Brewer-Nash 1989) Harrison-Ruzzo-Ullman (1976) Schematic Protection Model (Sandhu 1985) Typed Access Matrix Model (Sandhu 1992) ………………… RBAC solves this problem

12. © 2004 Ravi Sandhu www.list.gmu.edu Role-Based Access Control: The RBAC96 Model Ravi Sandhu, Edward Coyne, Hal Feinstein and Charles Youman, Role-Based Access Control Models. IEEE Computer, Volume 29, Number 2, February 1996, pages 38-47.

13. © 2004 Ravi Sandhu www.list.gmu.edu 13 ROLE-BASED ACCESS CONTROL (RBAC) A users permissions are determined by the users roles rather than identity or clearance roles can encode arbitrary attributes multi-faceted ranges from very simple to very sophisticated

14. © 2004 Ravi Sandhu www.list.gmu.edu 14 Central concept of RBAC ROLES USER-ROLE ASSIGNMENT PERMISSION-ROLE ASSIGNMENT USERSPERMISSIONS

15. © 2004 Ravi Sandhu www.list.gmu.edu 15 WHAT IS THE POLICY IN RBAC? RBAC is a framework to help in articulating policy The main point of RBAC is to facilitate security management

16. © 2004 Ravi Sandhu www.list.gmu.edu 16 RBAC SECURITY PRINCIPLES least privilege separation of duties separation of administration and access abstract operations

17. © 2004 Ravi Sandhu www.list.gmu.edu 17 RBAC96 IEEE Computer Feb. 1996 Policy neutral can be configured to do MAC roles simulate clearances (ESORICS 96) can be configured to do DAC roles simulate identity (RBAC98)

18. © 2004 Ravi Sandhu www.list.gmu.edu 18 WHAT IS RBAC? multidimensional open ended ranges from simple to sophisticated

19. © 2004 Ravi Sandhu www.list.gmu.edu 19 RBAC CONUNDRUM turn on all roles all the time turn on one role only at a time turn on a user-specified subset of roles

20. © 2004 Ravi Sandhu www.list.gmu.edu 20 RBAC96 FAMILY OF MODELS RBAC0 BASIC RBAC RBAC3 ROLE HIERARCHIES + CONSTRAINTS RBAC1 ROLE HIERARCHIES RBAC2 CONSTRAINTS

21. © 2004 Ravi Sandhu www.list.gmu.edu 21 RBAC0 ROLES USER-ROLE ASSIGNMENT PERMISSION-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS

22. © 2004 Ravi Sandhu www.list.gmu.edu 22 PERMISSIONS Primitive permissions read, write, append, execute Abstract permissions credit, debit, inquiry

23. © 2004 Ravi Sandhu www.list.gmu.edu 23 PERMISSIONS System permissions Auditor Object permissions read, write, append, execute, credit, debit, inquiry

24. © 2004 Ravi Sandhu www.list.gmu.edu 24 PERMISSIONS Permissions are positive No negative permissions or denials negative permissions and denials can be handled by constraints No duties or obligations outside scope of access control

25. © 2004 Ravi Sandhu www.list.gmu.edu 25 ROLES AS POLICY A role brings together a collection of users and a collection of permissions These collections will vary over time A role has significance and meaning beyond the particular users and permissions brought together at any moment

26. © 2004 Ravi Sandhu www.list.gmu.edu 26 ROLES VERSUS GROUPS Groups are often defined as a collection of users A role is a collection of users and a collection of permissions Some authors define role as a collection of permissions

27. © 2004 Ravi Sandhu www.list.gmu.edu 27 USERS Users are human beings or other active agents Each individual should be known as exactly one user

28. © 2004 Ravi Sandhu www.list.gmu.edu 28 USER-ROLE ASSIGNMENT A user can be a member of many roles Each role can have many users as members

29. © 2004 Ravi Sandhu www.list.gmu.edu 29 SESSIONS A user can invoke multiple sessions In each session a user can invoke any subset of roles that the user is a member of

30. © 2004 Ravi Sandhu www.list.gmu.edu 30 PERMISSION-ROLE ASSIGNMENT A permission can be assigned to many roles Each role can have many permissions

31. © 2004 Ravi Sandhu www.list.gmu.edu 31 MANAGEMENT OF RBAC Option 1: USER-ROLE-ASSIGNMENT and PERMISSION-ROLE ASSIGNMENT can be changed only by the chief security officer Option 2: Use RBAC to manage RBAC

32. © 2004 Ravi Sandhu www.list.gmu.edu 32 RBAC1 ROLES USER-ROLE ASSIGNMENT PERMISSION-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS ROLE HIERARCHIES

33. © 2004 Ravi Sandhu www.list.gmu.edu 33 HIERARCHICAL ROLES Health-Care Provider Physician Primary-Care Physician Specialist Physician

34. © 2004 Ravi Sandhu www.list.gmu.edu 34 HIERARCHICAL ROLES Engineer Hardware Engineer Software Engineer Supervising Engineer

35. © 2004 Ravi Sandhu www.list.gmu.edu 35 PRIVATE ROLES Engineer Hardware Engineer Software Engineer Supervising Engineer Hardware Engineer Software Engineer

36. © 2004 Ravi Sandhu www.list.gmu.edu 36 EXAMPLE ROLE HIERARCHY Employee (E) Engineering Department (ED) Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Director (DIR) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

37. © 2004 Ravi Sandhu www.list.gmu.edu 37 EXAMPLE ROLE HIERARCHY Employee (E) Engineering Department (ED) Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

38. © 2004 Ravi Sandhu www.list.gmu.edu 38 EXAMPLE ROLE HIERARCHY Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Director (DIR) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

39. © 2004 Ravi Sandhu www.list.gmu.edu 39 EXAMPLE ROLE HIERARCHY Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

40. © 2004 Ravi Sandhu www.list.gmu.edu 40 RBAC3 ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS ROLE HIERARCHIES CONSTRAINTS

41. © 2004 Ravi Sandhu www.list.gmu.edu 41 CONSTRAINTS Mutually Exclusive Roles Static Exclusion: The same individual can never hold both roles Dynamic Exclusion: The same individual can never hold both roles in the same context

42. © 2004 Ravi Sandhu www.list.gmu.edu 42 CONSTRAINTS Mutually Exclusive Permissions Static Exclusion: The same role should never be assigned both permissions Dynamic Exclusion: The same role can never hold both permissions in the same context

43. © 2004 Ravi Sandhu www.list.gmu.edu 43 CONSTRAINTS Cardinality Constraints on User-Role Assignment At most k users can belong to the role At least k users must belong to the role Exactly k users must belong to the role

44. © 2004 Ravi Sandhu www.list.gmu.edu 44 CONSTRAINTS Cardinality Constraints on Permissions-Role Assignment At most k roles can get the permission At least k roles must get the permission Exactly k roles must get the permission

45. © 2004 Ravi Sandhu www.list.gmu.edu The NIST-ANSI and (hopefully) soon- to-be ISO RBAC Standard Model David F. Ferraiolo, Ravi Sandhu, Serban Gavrila, D. Richard Kuhn and Ramaswamy Chandramouli. Proposed NIST Standard for Role-Based Access Control. ACM Transactions on Information and System Security, Volume 4, Number 3, August 2001, pages 224-274.

46. © 2004 Ravi Sandhu www.list.gmu.edu 46 The NIST-ANSI-ISO RBAC Model Adds much needed detail and consensus agreement to the RBAC96 model and other contemporary models Focuses on areas where consensus agreement exists and commercial implementations have been demonstrated Leaves many important areas for future work Eventual goal is much more ambitious Test suite for conformance testing

47. © 2004 Ravi Sandhu www.list.gmu.edu 47 RBAC96 FAMILY OF MODELS RBAC0 BASIC RBAC RBAC3 ROLE HIERARCHIES + CONSTRAINTS RBAC1 ROLE HIERARCHIES RBAC2 CONSTRAINTS

48. © 2004 Ravi Sandhu www.list.gmu.edu 48 The NIST-ANSI-ISO RBAC Model

49. © 2004 Ravi Sandhu www.list.gmu.edu 49 The NIST-ANSI-ISO RBAC Model Additional details Administrative Functions Supporting System Functions Review Functions

50. © 2004 Ravi Sandhu www.list.gmu.edu 50 Core RBAC

51. © 2004 Ravi Sandhu www.list.gmu.edu 51 Core RBAC: Administrative Functions AddUser DeleteUser AddRole DeleteRole AssignUser DeassignUser Grant-Permission Revoke-Permission

52. © 2004 Ravi Sandhu www.list.gmu.edu 52 Core RBAC: Supporting System Functions CreateSession AddActiveRole DropActiveRole CheckAccess

53. © 2004 Ravi Sandhu www.list.gmu.edu 53 Core RBAC: Review Functions Required AssignedUsers AssignedRoles Optional RolePermissions UserPermissions SessionRoles SessionPermissions RoleOperationsOnObject SessionOperationsOnObject Role-permission review is optional Role-user review is required

54. © 2004 Ravi Sandhu www.list.gmu.edu 54 Hierarchical RBAC

55. © 2004 Ravi Sandhu www.list.gmu.edu 55 Limited Hierarchies

56. © 2004 Ravi Sandhu www.list.gmu.edu 56 Limited Hierarchies

57. © 2004 Ravi Sandhu www.list.gmu.edu 57 General Hierarchies

58. © 2004 Ravi Sandhu www.list.gmu.edu 58 Inheritance versus Activation Hierarchy

59. © 2004 Ravi Sandhu www.list.gmu.edu 59 Inheritance versus Activation Hierarchy Inheritance hierarchy Activating Director Role also activates all junior roles (by inheritance of permissions) Violates least privilege Activation hierarchy Activating Director Role does not activate junior roles (there is no inheritance of permissions) Junior roles must be explicitly activated Preserves least privilege but is less automated

60. © 2004 Ravi Sandhu www.list.gmu.edu 60 Constrained RBAC: Static Separation of Duties

61. © 2004 Ravi Sandhu www.list.gmu.edu 61 Constrained RBAC: Dynamic Separation of Duties

62. © 2004 Ravi Sandhu www.list.gmu.edu MAC and DAC in RBAC Sylvia Osborn, Ravi Sandhu and Qamar Munawer. Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies. ACM Transactions on Information and System Security, Volume 3, Number 2, May 2000, pages 85-106.

63. © 2004 Ravi Sandhu www.list.gmu.edu 63 MAC H L M1M2 ReadWrite -+ +-

64. © 2004 Ravi Sandhu www.list.gmu.edu 64 MAC in RBAC96 HR LR M1RM2R LW HW M1WM2W Read Write - +

65. © 2004 Ravi Sandhu www.list.gmu.edu 65 MAC in RBAC96 user xR, user has clearance x user LW, independent of clearance Need constraints session xR iff session xW in a session exactly one read role must be activated, and this cannot be changed read can be assigned only to xR roles write can be assigned only to xW roles (O,read) assigned to xR iff (O,write) assigned to xW

66. © 2004 Ravi Sandhu www.list.gmu.edu 66 DAC in RBAC96 Construction is more complex Requires multiple roles for every object Revocation Grant-dependent revocation is harder to handle Grant-independent revocation is easier to handle

67. © 2004 Ravi Sandhu www.list.gmu.edu 67 MAC and DAC in the NIST-ANSI-ISO Model RBAC96 constructions use cardinality constraints in addition to Static and Dynamic separation of duties These constructions are not applicable to NIST- ANSI-ISO RBAC model Can NIST-ANSI-ISO RBAC model do MAC and DAC? With extensions: yes Without extensions: probably not

68. © 2004 Ravi Sandhu www.list.gmu.edu Administrative RBAC: ARBAC97 Ravi Sandhu, Venkata Bhamidipati and Qamar Munawer. The ARBAC97 Model for Role-Based Administration of Roles. ACM Transactions on Information and System Security, Volume 2, Number 1, February 1999, pages 105-135.

69. © 2004 Ravi Sandhu www.list.gmu.edu EXAMPLE ROLE HIERARCHY Employee (E) Engineering Department (ED) Project Lead 1 (PL1) Engineer 1 (E1) Production 1 (P1) Quality 1 (Q1) Director (DIR) Project Lead 2 (PL2) Engineer 2 (E2) Production 2 (P2) Quality 2 (Q2) PROJECT 2PROJECT 1

70. © 2004 Ravi Sandhu www.list.gmu.edu EXAMPLE ADMINISTRATIVE ROLE HIERARCHY Senior Security Officer (SSO) Department Security Officer (DSO) Project Security Officer 1 (PSO1) Project Security Officer 2 (PSO2)

71. © 2004 Ravi Sandhu www.list.gmu.edu 71 URA97 GRANT MODEL: can-assign ARolePrereq RoleRole Range PSO1ED[E1,PL1) PSO2ED[E2,PL2) DSOED(ED,DIR) SSOE[ED,ED] SSOED(ED,DIR]

72. © 2004 Ravi Sandhu www.list.gmu.edu 72 URA97 GRANT MODEL redundant assignments to senior and junior roles are allowed are useful

73. © 2004 Ravi Sandhu www.list.gmu.edu 73 URA97 REVOKE MODEL WEAK REVOCATION revokes explicit membership in a role independent of who did the assignment

74. © 2004 Ravi Sandhu www.list.gmu.edu 74 URA97 REVOKE MODEL STRONG REVOCATION revokes explicit membership in a role and its seniors authorized only if corresponding weak revokes are authorized alternatives –all-or-nothing –revoke within range

75. © 2004 Ravi Sandhu www.list.gmu.edu 75 URA97 REVOKE MODEL : can-revoke ARoleRole Range PSO1[E1,PL1) PSO2[E2,PL2) DSO(ED,DIR) SSO[ED,DIR]

76. © 2004 Ravi Sandhu www.list.gmu.edu 76 PERMISSION-ROLE ASSIGNMENT dual of user-role assignment can-assign-permission can-revoke-permission weak revoke strong revoke (propagates down)

77. © 2004 Ravi Sandhu www.list.gmu.edu 77 PERMISSION-ROLE ASSIGNMENT CAN-ASSIGN- PERMISSION ARolePrereq CondRole Range PSO1PL1[E1,PL1) PSO2PL2[E2,PL2) DSOE1 E2[ED,ED] SSOPL1 PL2 [ED,ED] SSOED[E,E]

78. © 2004 Ravi Sandhu www.list.gmu.edu 78 PERMISSION-ROLE ASSIGNMENT CAN-REVOKE- PERMISSION ARoleRole Range PSO1[E1,PL1] PSO2[E2,PL2] DSO(ED,DIR) SSO[ED,DIR]

79. © 2004 Ravi Sandhu www.list.gmu.edu OM-AM and RBAC

80. © 2004 Ravi Sandhu www.list.gmu.edu 80 THE OM-AM WAY Objectives Model Architecture Mechanism What? How? AssuranceAssurance

81. © 2004 Ravi Sandhu www.list.gmu.edu 81 LAYERS AND LAYERS Multics rings Layered abstractions Waterfall model Network protocol stacks Napolean layers RoFi layers OM-AM etcetera

82. © 2004 Ravi Sandhu www.list.gmu.edu 82 OM-AM AND MANDATORY ACCESS CONTROL (MAC) What? How? No information leakage Lattices (Bell-LaPadula) Security kernel Security labels AssuranceAssurance

83. © 2004 Ravi Sandhu www.list.gmu.edu 83 OM-AM AND DISCRETIONARY ACCESS CONTROL (DAC) What? How? Owner-based discretion numerous ACLs, Capabilities, etc AssuranceAssurance

84. © 2004 Ravi Sandhu www.list.gmu.edu 84 OM-AM AND ROLE-BASED ACCESS CONTROL (RBAC) What? How? Objective neutral RBAC96, ARBAC97, etc. user-pull, server-pull, etc. certificates, tickets, PACs, etc. AssuranceAssurance

85. © 2004 Ravi Sandhu www.list.gmu.edu 85 Server-Pull Architecture ClientServer User-role Authorization Server

86. © 2004 Ravi Sandhu www.list.gmu.edu 86 User-Pull Architecture ClientServer User-role Authorization Server

87. © 2004 Ravi Sandhu www.list.gmu.edu 87 Proxy-Based Architecture ClientServer Proxy Server User-role Authorization Server

88. © 2004 Ravi Sandhu www.list.gmu.edu 88 RBAC Mechanisms RBAC can be implemented using Secure cookies: user-pull architecture X.509 certificates: user-pull or server-pull architectures

89. © 2004 Ravi Sandhu www.list.gmu.edu Other RBAC Research and Results

90. © 2004 Ravi Sandhu www.list.gmu.edu 90 RBAC Research (dates are approximate) The early NIST model: Ferraiolo et al 1992 onwards Role-Graph Model: Osborn et al 1994 onwards OASIS model and architecture: Moody et al 1994 onwards Trust Management: Herzberg, Li, Winsborough, et al 1996 onwards Temporal RBAC: Bertino et al 1998 onwards Constraint languages: Ahn and Sandhu, 2000 Delegation in RBAC: Barka, Sandhu, Ahn et al 2000 onwards RBAC and workflow systems: Atluri, Sandhu, Ahn, Park et al 1998 onwards RBAC administration: Kern, Sandhu, Oh, Moffett et al 1998 onwards RBAC engineering: Thomsen, Kern, Epstein, Sandhu et al 2000 onwards Context-aware RBAC: Covington et al, 2000 onwards Rule-based RBAC: Al-Khatani and Sandhu, 2002 onwards ………………….

91. © 2004 Ravi Sandhu www.list.gmu.edu Ongoing and Future Work in RBAC

92. © 2004 Ravi Sandhu www.list.gmu.edu 92 Research Challenges Automated RBAC RBAC engineering Formal models for RBAC Analysis of RBAC policies Integration with attribute-based access control RBAC in pervasive and ad hoc environments Cross-domain RBAC ………….