Mohammad A. Al-Kahtani
George Mason University
US

Prof. Ravi Sandhu
SingleSignOn.net, Inc. & George Mason University
US

The Role-Based Access Control (RBAC) model has received wide acceptance in the computer security community. Based on a specific enterprise policy, RBAC is used to manually assign users to appropriate roles, thereby authorizing them to use the roles' permissions. In environments where the service-providing enterprise has a huge customer base this task becomes formidable. An appealing solution is to automatically assign users to roles. The central contribution of this paper is to describe a model to dynamically assign users to roles based on a finite set of rules defined by authorized people in the enterprise. These rules take into consideration the attributes users own and any constraints set forth by the enterprise’s security policy. The model also allows dynamic revocation of assigned roles based on conditions specified in the security policy. The model provides a language to express these rules and defines a mechanism to determine seniority among different rules. The paper also shows how to use the model to express Mandatory Access Controls (MAC) using the proposed language.

Keywords: RBAC,MAC, access control, Rule-based user-role assignment, dynamic assignment

Read Paper (in PDF)