1 / 47

Role-Based Access Control

SSD. (RH) Role Hierarchy. (UA) User Assign- ment. (PA) Permission Assignment. USERS. ROLES. OPS. OBS. PRMS. user_sessions. session_roles. SESSIONS. DSD. Role-Based Access Control. Overview. Objective. Compatibility with organizational structures Easy administration

kaloni
Download Presentation

Role-Based Access Control

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. SSD (RH) Role Hierarchy (UA) User Assign- ment (PA) Permission Assignment USERS ROLES OPS OBS PRMS user_sessions session_roles SESSIONS DSD Role-Based Access Control Overview Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  2. Objective • Compatibility with organizational structures • Easy administration • Expressiveness: DAC or MAC • Principle of least privilege • Separation of Duty (SoD) Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  3. Access Controls Types • Discretionary Access Control • Mandatory Access Control • Role-Based Access Control Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  4. Individuals Resources Server 1 Server 2 Server 3 Discretionary AC • Restricts access to objects based solely on the identity of users who are trying to access them. Application Access List LegacyApps Name Access Tom Yes John No Cindy Yes Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  5. Mandatory AC • MAC mechanisms assign a security level to all information, assign a security clearance to each user, and ensure that all users only have access to that data for which they have a clearance. Principle: Read Down Access equal or less Clearance Write Up Access equal or higher Clearance Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  6. Mandatory AC (cont) SIPRNET LegacyApps Individuals Resources Server 1 “Top Secret” Server 2 “Secret” Server 3 “Classified” Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  7. Role-Based AC • A user has access to an object based on the assigned role. • Roles are defined based on job functions. • Permissions are defined based on job authority and responsibilities within a job function. • Operations on an object are invocated based on the permissions. • The object is concerned with the user’s role and not the user. “Ideally, the [RBAC] system is clearly defined and agile, making the addition of new applications, roles, and employees as efficient as possible” Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  8. Role 1 Role 2 Role 3 Role-Based AC Individuals Roles Resources Server 1 Server 2 Server 3 User’s change frequently, Roles don’t Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  9. Privilege • Roles are engineered based on the principle of least privileged . • A role contains the minimum amount of permissions to instantiate an object. • A user is assigned to a role that allows him or her to perform only what’s required for that role. • No single role is given more permission than the same role for another user. Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  10. Role-Based AC Framework • Core Components • Constraining Components • Hierarchical RBAC • General • Limited • Separation of Duty Relations • Static • Dynamic Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  11. Core Components • Defines: • USERS • ROLES • OPERATIONS (ops) • OBJECTS (obs) • User Assignments (ua) • assigned_users Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  12. Core Components (cont) • Permissions (prms) • Assigned Permissions • Object Permissions • Operation Permissions • Sessions • User Sessions • Available Session Permissions • Session Roles Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  13. Constraint Components • Role Hierarchies (rh) • General • Limited • Separation of Duties • Static • Dynamic Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  14. RBAC Transition Least Privileged Separation of Duties Most Complex RBAC3 Effort RBAC Model Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  15. RBAC System and Administrative Functional Specification • Administrative Operations • Create, Delete, Maintain elements and relations • System Level Functions • Creation of user sessions • Role activation/deactivation • Constraint enforcement • Access Decision Calculation Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  16. (UA) User Assign- ment (PA) Permission Assignment USERS ROLES OPS OBS PRMS user_sessions session_roles SESSIONS Core RBAC Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  17. USERS Process Intelligent Agent Person Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  18. ROLES An organizational job function with a clear definition of inherent responsibility and authority (permissions). Director Developer Budget Manager Help Desk Representative Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  19. OPS (operations) An execution of an a program specific function that’s invocated by a user. • Database – Update Insert Append Delete • Locks – Open Close • Reports – Create View Print • Applications - Read Write Execute SQL Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  20. OBS (objects) An entity that contains or receives information, or has exhaustible system resources. • OS Files or Directories • DB Columns, Rows, Tables, or Views • Printer • Disk Space • Lock Mechanisms RBAC will deal with all the objects listed in the permissions assigned to roles. Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  21. UA (user assignment) ROLES set USERS set A user can be assigned to one or more roles Developer A role can be assigned to one or more users Help Desk Rep Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  22. UA (user assignment) Mapping of role r onto a set of users USERS set ROLES set User.F1 User.F2 User.F3 • User.DB1 • View • Update • Append User.DB1 permissions object User.DB1 Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  23. User.DB1 • View • Update • Append • User.F1 • Read • Write • Execute permissions permissions object object PRMS (permissions) The set of permissions that each grant the approval to perform an operation on a protected object. Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  24. PA (prms assignment) ROLES set PRMS set A prms can be assigned to one or more roles Create Delete Drop Admin.DB1 View Update Append A role can be assigned to one or more prms User.DB1 Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  25. PA (prms assignment) Mapping of role r onto a set of permissions ROLES set PRMS set User.F1 User.F2 User.F3 Admin.DB1 • Read • Write • Execute • View • Update • Append • Create • Drop SQL Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  26. guest admin invokes user SESSIONS The set of sessions that each user invokes. USER SESSION FIN1.report1 SQL DB1.table1 APP1.desktop Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  27. guest admin invokes user SESSIONS The mapping of user u onto a set of sessions. USERS SESSION User2.FIN1.report1.session USER1 SQL User2.DB1.table1.session USER2 User2.APP1.desktop.session Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  28. SESSIONS The mapping of session s onto a set of roles SESSION ROLES SQL • Admin • User • Guest DB1.table1.session Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  29. SQL DB1.table1.session DB1.ADMIN SESSIONS Permissions available to a user in a session. ROLE PRMS SESSION • View • Update • Append • Create • Drop Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  30. (RH) Role Hierarchy (UA) User Assign- ment (PA) Permission Assignment USERS ROLES OPS OBS PRMS user_sessions session_roles SESSIONS Hierarchal RBAC Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  31. Production Engineer 1 Quality Engineer 1 Production Engineer 2 Quality Engineer 2 Engineer 1 Engineer 2 Director Engineering Dept Project Lead 1 Project Lead 2 Production Engineer 1 Production Engineer 2 Quality Engineer 1 Quality Engineer 2 Tree Hierarchies Tree Inverted Tree Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  32. Production Engineer 1 Quality Engineer 1 Production Engineer 2 Quality Engineer 2 Engineer 1 Engineer 2 Director Engineering Dept Project Lead 1 Project Lead 2 Lattice Hierarchy Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  33. RH (Role Hierarchies) • Natural means of structuring roles to reflect organizational lines of authority and responsibilities • General and Limited • Define the inheritance relation among roles i.e. r1inheritsr2 User r-w-h Guest -r- Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  34. General RH Support Multiple Inheritance Guest Role Set User Role Set Power User Role Set Admin Role Set Only if all permissions of r1 are also permissions of r2 i.e. r1 inherits r2 Only if all users of r1 are also users of r2 User r-w-h Guest -r- Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  35. authorized users Mapping of a role onto a set of users in the presence of a role hierarchy First Tier USERS set ROLES set Admin.DB1 User.DB2 User.DB3 User.DB1 • User.DB1 • View • Update • Append permissions object User.DB1 Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  36. authorized permissions Mapping of a role onto a set of permissions in the presence of a role hierarchy ROLES set PRMS set User.DB1 User.DB2 User.DB3 Admin.DB1 • View • Update • Append • Create • Drop SQL Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  37. Limited RH A restriction on the immediate descendants of the general role hierarchy Role2 Role2 inherits from Role1 Role3 Role3 does not inherit from Role1 or Role2 Role1 Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  38. Fred Curt Tuan Tom AcctRecSpv Sally Joe Tammy CashierSpv Frank BillingSpv Billing AcctRec Auditing Cashier Accounting Limited RH (cont) Accounting Role Notice that Frank has two roles: Billing and Cashier Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  39. SSD (RH) Role Hierarchy (UA) User Assign- ment (PA) Permission Assignment USERS ROLES OPS OBS PRMS user_sessions session_roles SESSIONS DSD Constrained RBAC Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  40. Separation of Duties • Enforces conflict of interest policies employed to prevent users from exceeding a reasonable level of authority for their position. • Ensures that failures of omission or commission within an organization can be caused only as a result of collusion among individuals. • Two Types: • Static Separation of Duties (SSD) • Dynamic Separation of Duties (DSD) Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  41. SSD (SMER) • SSD places restrictions on the set of roles and in particular on their ability to form UA relations. • No user is assigned to n or more roles from the same role set, where n or more roles conflict with each other. • A user may be in one role, but not in another—mutually exclusive. • Prevents a person from submitting and approving their own request. Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  42. SSD in Presence of RH • A constraint on the authorized users of the roles that have an SSD relation. • Based on the authorized users rather than assigned users. • Ensures that inheritance does not undermine SSD policies. • Reduce the number of potential permissions that can be made available to a user by placing constraints on the users that can be assigned to a set of roles. Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  43. DSD (DMER) • These constraints limit the number of roles a user can activate in a single session • Examples of constraints: • No user may activate t or more roles from the roles set in each user session. • If a user has used role r1 in a session, he/she cannot use role r2 in the same session • Enforcement of these roles requires keeping the history of the user access to roles within a session Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  44. Constraint RBAC Static SoD (SSD) Dynamic SOD (DSD) Approve/ Disapprove check Prepare check Summarize decisions Issue/avoid check Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  45. Other Types of Constraints • At least n users are required to have all kpermissions. • ( {p1,p2,…,pk}, n ) • Enforcement • Static Enforcement • Dynamic Enforcement Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  46. SoD Example • Purchase Process • Order goods and record details of order • Receive invoice and check against order • Receive goods and check against invoice • Authorize payment against invoice • A set of SoD requirements: • ssd: No user performs (1) and (3). • At least 3 users to perform all 4 steps Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

  47. QUESTIONS…COMMENTS?? Morteza Amini; 2nd Semester 85-86; Database Security; Sharif Univ. of Tech.

More Related