prox rbac a proximity based spatially aware rbac
play

Prox-RBAC: A Proximity-based Spatially Aware RBAC Michael S. - PowerPoint PPT Presentation

Mar 14, 2023 •22 likes •482 views

Prox-RBAC: A Proximity-based Spatially Aware RBAC Michael S. Kirkpatrick Maria Luisa Damiani Elisa Bertino 19 th ACM SIGSPATIAL International Conference on Advances in Geographic Information Systems (GIS) Chicago, IL, USA November 4, 2011

  1. Prox-RBAC: A Proximity-based Spatially Aware RBAC Michael S. Kirkpatrick Maria Luisa Damiani Elisa Bertino 19 th ACM SIGSPATIAL International Conference on Advances in Geographic Information Systems (GIS) Chicago, IL, USA November 4, 2011 Wednesday, November 9, 2011

  2. Motivation M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 2 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  3. Motivation M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 2 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  4. Motivation M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 2 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  5. Motivation • GEO-RBAC augments access control with spatial data • <Doctor, coffeeshop> vs. <Doctor, ER> • Spatial role based on requesting user’s location • Others’ locations have security implications • Separation of duty • Presence of unprivileged users ( e.g. , civilians) M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 3 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  6. Motivation • GEO-RBAC augments access control with spatial data • <Doctor, coffeeshop> vs. <Doctor, ER> • Spatial role based on requesting user’s location • Others’ locations have security implications • Separation of duty • Presence of unprivileged users ( e.g. , civilians) M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 3 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  7. Key Issues • Space model • Language definition • Location integrity • Technological feasibility M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 4 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  8. Key Issues GIS Access Control • Space model This talk • Language definition • Location integrity • Technological feasibility Crypto Formal Methods/ Languages M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 4 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  9. Space Model M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 5 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  10. Space Model • Indoor space model • Protected area (PA) • Entry points M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 5 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  11. Space Model M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 5 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  12. Space Model M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 6 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  13. Space Model M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 6 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  14. Space Model M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 6 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  15. Accessibility Graph • Directed multigraph • Nodes denote protected areas • Edges denote entry points M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 7 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  16. Hierarchical Containment • Partial order pa i ⊆ pa j Π • s ∈ pa i ⇒ s ∈ pa j • Entry into pa i requires presence in pa j • pa i ⊆ pa j and pa i ⊆ pa k ⇒ pa j ⊆ pa k or pa k ⊆ pa j Π Π Π Π M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 8 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  17. Parent Tree • Accessibility graph alone is insufficient • Hierarchical space model • Typing of areas • Room, floor, suite, etc. • User locations are at finest granularity M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 9 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  18. Authorized PAs • AuthPA(s) • PAs subject s is authorized to enter • pa i ∈ AuthPA(s) implies Parent(pa i ) ∈ AuthPA(s) • If pa i ∈ AuthPA(s) and pa i only reachable from sibling pa j , then pa j ∈ AuthPA(s) M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 10 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  19. Authorized PAs • AuthPA(s) • PAs subject s is authorized to enter • pa i ∈ AuthPA(s) implies Parent(pa i ) ∈ AuthPA(s) • If pa i ∈ AuthPA(s) and pa i only reachable from sibling pa j , then pa j ∈ AuthPA(s) M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 10 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  20. Authorized PAs • AuthPA(s) • PAs subject s is authorized to enter • pa i ∈ AuthPA(s) implies Parent(pa i ) ∈ AuthPA(s) • If pa i ∈ AuthPA(s) and pa i only reachable from sibling pa j , then pa j ∈ AuthPA(s) M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 10 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  21. Policy Language M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  22. Policy Language • Relative constraint clause at_least 1 supervisor in Room 100 • Continuity of usage while (at_most 0 civilians in this.room) • Timeout constraint while (...) timeout 1 minute M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  23. Policy Language Any topological relationship • Relative constraint clause at_least 1 supervisor in Room 100 • Continuity of usage while (at_most 0 civilians in this.room) • Timeout constraint while (...) timeout 1 minute M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  24. Policy Language • Relative constraint clause at_least 1 supervisor in Room 100 • Continuity of usage while (at_most 0 civilians in this.room) • Timeout constraint while (...) timeout 1 minute M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  25. Policy Language • Relative constraint clause at_least 1 supervisor in Room 100 • Continuity of usage while (at_most 0 civilians in this.room) • Timeout constraint while (...) timeout 1 minute M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  26. Policy Language • Relative constraint clause at_least 1 supervisor in Room 100 • Continuity of usage while (at_most 0 civilians in this.room) • Timeout constraint while (...) timeout 1 minute M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 11 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  27. Semantics M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 12 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  28. Semantics User is in the PA, authorized to enter role M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 12 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  29. Semantics Other users also satisfy constraints M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 12 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  30. Semantics Access stopped when others ... move M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 12 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  31. Enforcement LD LD LD AS LD LD LD LD LD LD M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 13 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  32. Enforcement LD LD LD AS LD Proof of LD location LD LD LD LD M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 13 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  33. Enforcement LD LD LD AS LD LD Proof + LD LD credentials LD LD M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 13 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  34. Request Protocol M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 14 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  35. Request Protocol Bind the user to the location at the time M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 14 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  36. Request Protocol Send request and signed commitment M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 14 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

  37. Request Protocol Prove commitment matches M. S. Kirkpatrick, M. L. Damiani, E. Bertino ACM GIS 2011 14 Prox-RBAC: A Proximity-based Spatially Aware RBAC Wednesday, November 9, 2011

Recommend

ROLE BASED ACCESS CONTROL (RBAC) John Barkley RBAC Project Leader Software Diagnostics and

ROLE BASED ACCESS CONTROL (RBAC) John Barkley RBAC Project Leader Software Diagnostics and

ROLE BASED ACCESS CONTROL (RBAC) John Barkley RBAC Project Leader Software Diagnostics and Conformance Testing National Institute of Standards and Technology (301) 975-3346 jbarkley@nist.gov http://hissa.nist.gov/rbac/ ACTIVE PARTICIPANTS

635 views • 27 slides
Tie-RBAC An application of RBAC to Social Networks Antonio Tapiador Diego Carrera Joaqun

Tie-RBAC An application of RBAC to Social Networks Antonio Tapiador Diego Carrera Joaqun

Tie-RBAC An application of RBAC to Social Networks Antonio Tapiador Diego Carrera Joaqun Salvacha Departamento de Ingeniera de Sistemas Telemticos ETS de Ingenieros de Telecomunicacin Universidad Politcnica de Madrid Access

146 views • 14 slides
1 Core RBAC (2) Core RBAC (3) UA USERS ROLES SESSIONS assigned_users : ( r :

1 Core RBAC (2) Core RBAC (3) UA USERS ROLES SESSIONS assigned_users : ( r :

Announcements CS590U Class mailing list Access Control: Theory and David Ferraiolo visit on Sep 16/17 Practice sign-up sheet to meet him after the class Proposal due Sep 30 (20% of grade) Lecture 5 (September 9 th ) Student

437 views • 6 slides
Contextual Privacy Management in Extended RBAC Model Nabil Ajam, Nora Cuppens, Frdric

Contextual Privacy Management in Extended RBAC Model Nabil Ajam, Nora Cuppens, Frdric

Contextual Privacy Management in Extended RBAC Model Nabil Ajam, Nora Cuppens, Frdric Cuppens 24 september 2009 page 1 Workshop DPM Nabil Ajam Plan Introduction Motivation to use RBAC models Privacy requirements as OrBAC

461 views • 24 slides
Elaborating and Verifying RBAC Policies Conforming with CobiT Framework Requirements Christophe

Elaborating and Verifying RBAC Policies Conforming with CobiT Framework Requirements Christophe

Third International Workshop on Requirements Engineering and Law (RELAW 10) - September 28 th 2010 Conceptualizing a Responsibility based Approach for Elaborating and Verifying RBAC Policies Conforming with CobiT Framework Requirements

429 views • 27 slides
Role-based access control Role-based access control 1 RBAC: Motivations Complexity of

Role-based access control Role-based access control 1 RBAC: Motivations Complexity of

Role-based access control Role-based access control 1 RBAC: Motivations Complexity of security administration p y y For large number of subjects and objects, the number of authorizations can become extremely large For dynamic

536 views • 51 slides
XACML and Role-Based Access Control Jason Crampton Royal Holloway, University of London DIMACS

XACML and Role-Based Access Control Jason Crampton Royal Holloway, University of London DIMACS

XACML and Role-Based Access Control Jason Crampton Royal Holloway, University of London DIMACS Workshop on Secure Web Services and e-Commerce XACML and RBAC/Introduction Jason Crampton Programme Examine the XACML standard and the XACML RBAC

499 views • 32 slides
Role-based access control 1 RBAC: Motivations Complexity of security administration For

Role-based access control 1 RBAC: Motivations Complexity of security administration For

Role-based access control 1 RBAC: Motivations Complexity of security administration For large number of subjects and objects, the number of o a ge u be o subjects a d objects, t e u be o authorizations can become extremely large

783 views • 26 slides
Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal Holloway, University of London 7th International Workshop on Security and Trust Management Risk-Aware RBAC Introduction Introduction

604 views • 16 slides
RBAC Administration in Distributed Systems Policy Distribution Concluding Remarks Marnix

RBAC Administration in Distributed Systems Policy Distribution Concluding Remarks Marnix

Introduction Modeling Distributed Systems RBAC Administration in Distributed Systems Policy Distribution Concluding Remarks Marnix Dekker, Jason Crampton, Sandro Etalle Questions Distributed and Embedded Systems groep (DIES), Universitity

541 views • 26 slides
Preservation of prox-regularity Florent Nacry 1 Based on a joint work with Samir Adly and Lionel

Preservation of prox-regularity Florent Nacry 1 Based on a joint work with Samir Adly and Lionel

Notation and preliminaries Preservation of prox-regularity: state of the art Prox-regularity and generalized equations Future works and references Preservation of prox-regularity Florent Nacry 1 Based on a joint work with Samir Adly and Lionel

457 views • 44 slides
Pros and cons for using LDAP as backend for an RBAC system 3 rd LDAPCon, Heidelberg,

Pros and cons for using LDAP as backend for an RBAC system 3 rd LDAPCon, Heidelberg,

Pros and cons for using LDAP as backend for an RBAC system 3 rd LDAPCon, Heidelberg, 10.-11.10.2011 Peter Gietz, Markus Widmer, DAASI International GmbH Peter.gietz@daasi.de Markus.widmer@daasi.de 1 (c) October 2011 DAASI

815 views • 52 slides
Proximity-Aware Directory-based Coherence for Multi-core Processor Architectures Jeff Brown

Proximity-Aware Directory-based Coherence for Multi-core Processor Architectures Jeff Brown

Proximity-Aware Directory-based Coherence for Multi-core Processor Architectures Jeff Brown Rakesh Kumar Dean Tullsen UC San Diego University of Illinois at Urbana-Champaign SPAA19 June 9, 2007 Introduction The chip multiprocessor

948 views • 76 slides
Delegation in Role-Based Access Control Controlling delegation Enforcing transfer delegation

Delegation in Role-Based Access Control Controlling delegation Enforcing transfer delegation

Introduction Delegation operations in hierarchical RBAC Delegation in Role-Based Access Control Controlling delegation Enforcing transfer delegation Jason Crampton Hemanth Khambhammettu semantics Conclusion Information Security

959 views • 57 slides
Role-Based Access Control CS461/ECE422 Spring 2012 Reading

Role-Based Access Control CS461/ECE422 Spring 2012 Reading

Role-Based Access Control CS461/ECE422 Spring 2012 Reading Material Chapter 4, sec?ons 4.5 and 4.6 [SFK00] DAC vs RBAC DAC Users, Groups

415 views • 25 slides
Preservation of uniform prox-regularity of sets and application to constrained optimization

Preservation of uniform prox-regularity of sets and application to constrained optimization

Uniform prox-regular sets in Hilbert setting Uniform prox-regularity of constraint sets Application to constrained optimization Inverse image, intersection Preservation of uniform prox-regularity of sets and application to constrained

739 views • 54 slides
A Distributed Calculus for Role-Based Access Control Chiara Braghin joint work with D. Gorla and

A Distributed Calculus for Role-Based Access Control Chiara Braghin joint work with D. Gorla and

A Distributed Calculus for Role-Based Access Control Chiara Braghin joint work with D. Gorla and V. Sassone MyThS Meeting, Venice, June, 14th, 2004 A Distributed Calculus for Role-Based Access Control p.1/18 RBAC Why: Role-Based Access

613 views • 36 slides
Beautiful REST + JSON APIs Les Hazlewood, @lhazlewood Founder &amp; CTO, Stormpath About

Beautiful REST + JSON APIs Les Hazlewood, @lhazlewood Founder &amp; CTO, Stormpath About

Beautiful REST + JSON APIs Les Hazlewood, @lhazlewood Founder &amp; CTO, Stormpath About Stormpath User Management API for Developers Registration and Login User Profiles Role Based Access Control (RBAC) Permissions

1.26k views • 86 slides
Proximity-based Outlier Detection Objects far away from the others are outliers The

Proximity-based Outlier Detection Objects far away from the others are outliers The

Proximity-based Outlier Detection Objects far away from the others are outliers The proximity of an outlier deviates significantly from that of most of the others in the data set Distance-based outlier detection: An object o is an

416 views • 39 slides
Towards Proximity Graph Auto-Configuration: an Approach Based on Meta-learning Rafael S. Oyamada,

Towards Proximity Graph Auto-Configuration: an Approach Based on Meta-learning Rafael S. Oyamada,

Towards Proximity Graph Auto-Configuration: an Approach Based on Meta-learning Rafael S. Oyamada, Larissa C. Shimomura, Sylvio Barbon Junior, and Daniel S. Kaster. Summary Introduction and Concepts Similarity Searches Proximity

283 views • 26 slides
Planar Delaunay Triangulations and Proximity Structures Proximity Structures Given: a set P of n

Planar Delaunay Triangulations and Proximity Structures Proximity Structures Given: a set P of n

Wolfgang Mulzer Institut f r Informatik Planar Delaunay Triangulations and Proximity Structures Proximity Structures Given: a set P of n points in the plane proximity structure : a structure that encodes useful information about the local

802 views • 57 slides
51 52 Proximity-based social networks. Talking to strangers

51 52 Proximity-based social networks. Talking to strangers

51 52 Proximity-based social networks. Talking to strangers will become a big trend in 2013. Proximity-based social networks will allow you to

438 views • 11 slides
On Permissions, Inheritance and Role Hierarchies Jason Crampton Information Security Group

On Permissions, Inheritance and Role Hierarchies Jason Crampton Information Security Group

On Permissions, Inheritance and Role Hierarchies Jason Crampton Information Security Group Royal Holloway, University of London Introduction The role hierarchy is central to most RBAC models Modelled as a partially ordered set R

834 views • 25 slides
The Chinese Wall Conflict of Interests Access Control Model Chinese Wall Policy

The Chinese Wall Conflict of Interests Access Control Model Chinese Wall Policy

Introduction Access Control Models Other models: Part II The Chinese Wall Model it combines elements of DAC and MAC RBAC Model it is a DAC model; however, it is Elisa Bertino sometimes considered a policy-neutral model

611 views • 12 slides

More recommend