1. © 2005 Ravi Sandhu www.list.gmu.edu Administrative Scope (best viewed in slide show mode) Ravi Sandhu Laboratory for Information Security Technology George Mason University www.list.gmu.edu sandhu@gmu.edu

2. © 2005 Ravi Sandhu www.list.gmu.edu 2 Administrative Scope Jason Crampton and George Loizou. Administrative scope: A foundation for role-based administrative models. ACM Transactions on Information and System Security, Volume 6, Number 2, May 2003, pages 201-231. Several diagrams and text excerpts are taken directly from this paper.

3. © 2005 Ravi Sandhu www.list.gmu.edu 3 Administrative Scope

4. © 2005 Ravi Sandhu www.list.gmu.edu 4 Example Hierarchies

5. © 2005 Ravi Sandhu www.list.gmu.edu 5 Notation Immediate childrenImmediate parentsMinimal roles Maximal roles Junior rolesSenior roles

6. © 2005 Ravi Sandhu www.list.gmu.edu 6 Four Operations

7. © 2005 Ravi Sandhu www.list.gmu.edu 7 Semantics of Edge Operations

8. © 2005 Ravi Sandhu www.list.gmu.edu 8 Edge Insertion Anomaly YNNYNN NNYNNY AddEdge(DSO,PE1,QE1) Y

9. © 2005 Ravi Sandhu www.list.gmu.edu 9 Administrative Scope

10. © 2005 Ravi Sandhu www.list.gmu.edu 10 Evolving Administrative Scope Dynamic administrative scope Versus Static can-modify

11. © 2005 Ravi Sandhu www.list.gmu.edu 11 Administrative Scope r is an immediate child of r

12. © 2005 Ravi Sandhu www.list.gmu.edu 12 RHA Conditions for Four Operations These conditions always apply RHA1 Additional conditions may be imposed RHA2, RHA3, RHA4

13. © 2005 Ravi Sandhu www.list.gmu.edu 13 RHA1 Regular roles are also administrative roles A role administers roles in its administrative scope No further conditions Too permissive ED administers E

14. © 2005 Ravi Sandhu www.list.gmu.edu 14 RHA2 RHA1 plus Only roles explicitly designated as administrators can administer Say DIR, PL1, PL2 but not ED and the others

15. © 2005 Ravi Sandhu www.list.gmu.edu 15 RHA3

16. © 2005 Ravi Sandhu www.list.gmu.edu 16 RHA3