Homayun MOTAMENI, Fatemeh NAZERIAN, Hossein NEMATZADEH

Secure access control in multidomain environments and formal analysis of model specifications

Distributed multiple organizations interact with each other. If the domains employ role-based access control,one method for interaction between domains is role-mapping. However, it may violate constraints in the domainssuch as role hierarchy, separation of duty, and cardinality. Therefore, autonomy of the domains is lost. This paperproposes secure interoperation in multidomain environments. For this purpose, a cross-domain is created by foreignpermission assignment. In an effort to maintain the autonomy of every domain, several rules are defined formally. Then,a decentralized scheme is used to provide permission mapping between domains. At the next stage, the proposed crossdomain is specified using Alloy, the first logic language. Subsequently, validity of the rules is analyzed through Alloyanalyzer

PDF

___

Huang H, Krichner H. Secure interoperation design in multi-domains environments based on colored Petri nets. Inform Sciences 2013; 221: 591-606.
Shafiq B, Joshi JBD, Bertino E, Ghafoor A. Secure interoperation in a multidomain environment employing RBAC policies. IEEE T Knowl Data En 2005; 17: 1557-1577.
Hu J, Li R, Lu Z. Establishing RBAC-based secure interoperability in decentralized multidomain environments. In: Proceedings of 10th International Conference on Information Security and Cryptography; 29–30 November 2007; Seoul, Korea. pp. 49-63.
Lu J, Li R, Varadharajan V, Lu Z, Ma X. Secure interoperation in multidomain environment employing UCON policies. In: International Conference on Information security; 2009; Springer, Heidelberg. pp. 395-402.
Ultra JD, Pancho-Festin S. A simple model of separation of duty for access control models. Comput Secur 2017; 68: 69-80.
Bijon KZ, Krishnan R, Sandhu R. Toward an attribute based constraints specification language. In: International Conference on Social Computing; 8–14 September 2013; Alexandria, VA, USA. pp. 108-113.
Jackson D. Software Abstraction: Logic, Language, and Analysis. Cambridge, MA, USA: MIT Press, 2006.
Giammarco K. A formal method for assessing architecture model and design maturity using domain-independent patterns. Procedia Comput Sci 2014; 28: 555-564.
Cunha A, Garis A, Riesco D. Translating between Alloy specification and UML class diagrams annotate with OCL. Softw Syst Model 2015; 14: 5-25
Schaad A, D.Moffett J. A lightweight approach to specification and analysis of role-based access control extensions. In: Proceedings of the 7th ACM Symposium on Access Control Models and Technologies; 3–4 June 2002; Monterey, CA, USA. pp. 13-22.
Jha S, Sural S, Vaidya J, Atluri V. Security analysis of temporal RBAC under an administrative model. Comput Secur 2014; 46: 154-172.
Massoni T, Gheyi R, Borba P. A UML class diagram analyzer. In: 3rd International Workshop on Critical System Development with UML; January 2004; Lisbon, Portugal. pp. 100-114
Osborn S, Sandhu R, Munawer Q. Configuring role-based access control to enforce mandatory and discretionary access control policies. ACM T Inform Syst Se 2000; 3: 85-106.
Osborn S. Mandatory access control and role-based access control revisited. In: RBAC ’97 Proceedings of the second ACM workshop on role-based access control; 6-7 November 1997; ACM New York, NY, USA. pp. 31-40.
Sandhu R, Coyne EJ, Feinstein HL, Youman CE. Role-based access control models. IEEE Comput Soc 1996; 29: 38-47. doi.10.1109/2.485845.
Bertino E. RBAC models – concepts and trend. Comput Secur 2003; 22: 511-514.
Jin X, Krishnan R, Sandhu R. A unified attribute-based access control model covering DAC, MAC and RBAC. In: Proceedings of the 26th Aunal IFIP WG 11.3 conference on Data and Application Security and Privacy; 11–13 July 2012; Paris, France. pp. 41-55.
Ferraiolo DF, Sandhu R, Gavrila S, Kuhn DR, Chandramouli R. Proposed NIST standard for role-based access control. ACM T Inform Syst Se 2001; 4: 224-74.
Uğur A, Soğukpınar İ. Multilayer authorization model and analysis of authorization method. Turk J Electr Eng Co 2016; 24: 4915-4934. doi:10.3906/elk-1403-200.
Bertino E, Bonatti PA, Ferrari E. TRBAC: a temporal role-based access control model. ACM T Inform Syst Se 2001; 4: 191-233. doi.10.1145/5019 78.501979.
Ferreira A, Chadwick D, Farinha P, Correia R, Zao G, Chilro R, Antunes L. How to security break into RBAC: the BTG-RBAC model. In: Annual Computer Security Applications Conference; 7–11 December 2009; Honolulu, HI, USA. pp. 23-31. doi.10.1109/ACSAC.2009.12.
Liu G, Zhang R, Song H, Wang C, Liu J. Ts-RBAC: A RBAC model with transformation. Comput Secur 2016; 60: 52-61.
Fuchs L, Pernul G, Sandhu R. Roles in information security – a survey and classification of the research area. Comput Secur 2011; 30: 748-769.
Sandhu R, Bhamidipati V, Munawer Q. The ARBAC97 model for role-based administration of roles. ACM T Inform Syst Se 1996; 2: 105-135.
Sandhu R, Munawer Q. The ARBAC99 model for administration of roles. In: Proceeding 15th Annual computer security applications conference; 6–10 December 1999; Phoenix, AZ, USA. pp. 229-38.
Oh S, Sandhu R. A model for role administration using organization structure. In: Proceedings of the 7th ACM Symposium on Access Control Models and Technologies; 3–4 June 2002; Monterey, California, USA. pp. 155-62.
Kapadia A, Al-Muhtadi J, Campbell RH, Mickunas D. IRBAC 2000: Secure interoperability using dynamic role translation. In: Proceedings of the 1st International Conference on Internet Computing; 26-29 June 2000; Las Vegas, NV, USA. pp. 231-238.
Al-Muhtadi J, Kapadia A, Campbell R, Mickunas D. The A-IRBAC2000 model: administrative interoperable rolebase access control. ACM T Inform Syst Se 2001; 3: 173-182.
Yang Z, Wang J, Yang L, Yang R, Kou B, Chen J, Yang S. The RBAC model and implementation architecture in multi-domain environment. Electron Commer Res 2013; 13: 273-289.
Lin G, Bie Y, Lei M. Trust based access control policy in multi-domain of cloud computing. J Comput 2013; 8: 1357-1365.
Gong L, Qian X. Computational issues in secure interoperation. IEEE T Software Eng 1996; 22: 43-52. doi. 10.1109/32.481533.
Zhu H, Duan S, Hong F, Lu K. An access-control policy based on sharing resource management for a multi-domains environment. In: Proceedings of the Third International conference on Autonomic and Trusted Computing; 3–6 September 2006; Wuhan, China. pp. 439-448.
Piromruen S, Joshi JBD. An RBAC framework for time constrained secure interoperation in multi-domain environments. In: Proceeding of the 10th IEEE International Workshop on Object-Oriented Real-Time Dependable Systems; 2–4 Feb 2005; Sedona, AZ, USA. pp. 36-45.
Wang X, Feng D, Xu Z, Hu H. Mediator-free secure policy interoperation of exclusively-trusted multiple domain. In: Proceedings of the International Conference on Information Security Practice and Experience; 21–23 April 2008; Sydney, Australia. pp. 248-262.
ANSI, American National standard for Information Technology ”Role-Based Access Control”. American National Standard Institute, 2004.
Esna-Ashari M, Rabiee HR, MirianHosseinabadi SH. Reliability of separation of duty in ANSI standard role-based access control. Sci Iran 2011; 18: 1416-1424.
Park J, Sandhu R. The UCONABC usage control model. ACM T Inform Syst Se 2004; 7: 128-174. doi.10.1145/984 334.984339.