Issue No. 06 - November/December (2011 vol. 8)
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/TDSC.2010.55
Elisa Bertino , Purdue University, West Lafayette
Mikhail (Mike) J. Atallah , Purdue University, West Lafayette
Ninghui Li , Purdue University, West Lafayette
Qihua Wang , IBM Almaden Research Center, USA
Yuqing Sun , Shandong University, Jinan
In practice, assigning access permissions to users must satisfy a variety of constraints motivated by business and security requirements. Here, we focus on Role-Based Access Control (RBAC) systems, in which access permissions are assigned to roles and roles are then assigned to users. User-role assignment is subject to role-based constraints, such as mutual exclusion constraints, prerequisite constraints, and role-cardinality constraints. Also, whether a user is qualified for a role depends on whether his/her qualification satisfies the role's requirements. In other words, a role can only be assigned to a certain set of qualified users. In this paper, we study fundamental problems related to access control constraints and user-role assignment, such as determining whether there are conflicts in a set of constraints, verifying whether a user-role assignment satisfies all constraints, and how to generate a valid user-role assignment for a system configuration. Computational complexity results and/or algorithms are given for the problems we consider.
Access control, RBAC, formal methods, computational complexity.
Elisa Bertino, Mikhail (Mike) J. Atallah, Ninghui Li, Qihua Wang, Yuqing Sun, "On the Complexity of Authorization in RBAC under Qualification and Security Constraints", IEEE Transactions on Dependable and Secure Computing, vol. 8, no. , pp. 883-897, November/December 2011, doi:10.1109/TDSC.2010.55