1. © 2005 Ravi Sandhu www.list.gmu.edu Administrative Scope (continued) (best viewed in slide show mode) Ravi Sandhu Laboratory for Information Security Technology George Mason University www.list.gmu.edu sandhu@gmu.edu

2. © 2005 Ravi Sandhu www.list.gmu.edu 2 RHA Conditions for Four Operations These conditions always apply RHA1 Additional conditions may be imposed RHA2, RHA3, RHA4 These are allowed to be

3. © 2005 Ravi Sandhu www.list.gmu.edu 3 RHA: Add role Y with no children (scope PL1) Y

4. © 2005 Ravi Sandhu www.list.gmu.edu 4 RHA: Insert edge ENG1, Y (scope PL1) Y

5. © 2005 Ravi Sandhu www.list.gmu.edu 5 RHA: Delete edge ENG1, Y (scope PL1) Y outside scope of PL1 so cannot get back to childless Y

6. © 2005 Ravi Sandhu www.list.gmu.edu 6 RHA: Add role Y with no parents (scope PL1) scope of PL1 scope of DIR

7. © 2005 Ravi Sandhu www.list.gmu.edu 7 RHA: Add role Y with no parents (scope PL1) Y scope of PL1 scope of DIR

8. © 2005 Ravi Sandhu www.list.gmu.edu 8 RHA Conditions for Four Operations These conditions always apply RHA1 Additional conditions may be imposed RHA2, RHA3, RHA4 These are allowed to be May not be a good idea, especially for parents

9. © 2005 Ravi Sandhu www.list.gmu.edu 9 RHA3

10. © 2005 Ravi Sandhu www.list.gmu.edu 10 RHA3

11. © 2005 Ravi Sandhu www.list.gmu.edu 11 RHA3: Administrative Scope

12. © 2005 Ravi Sandhu www.list.gmu.edu 12 RHA3 S + (PSO1) S + (DSO)

13. © 2005 Ravi Sandhu www.list.gmu.edu 13 RHA3: PSO1 creates Y S + (PSO1) S + (DSO) Y

14. © 2005 Ravi Sandhu www.list.gmu.edu 14 RHA3: Consistency Constraints

15. © 2005 Ravi Sandhu www.list.gmu.edu 15 RHA4: admin-authority operations

16. © 2005 Ravi Sandhu www.list.gmu.edu 16 RHA4: creation of parentless roles not allowed Forces PSO1 as administrator of X Should be DSO? Eliminated from admin-hierarchy