TRBAC A Temporal RoleBased Access Control Model Elisa Bertino CERIAS and CS Department Purdue University What is TRBAC RBAC Model Sandhu 98 Temporal constraints on role activations deactivations Elisa Bertino Purdue University What is TRBAC An active role is a role that a user can activate during a session that is the user can acquire the role s A role can be active in certain time periods and non active in other Role activation non active active Role deactivation active non active Elisa Bertino Purdue University Why TRBAC Often roles are characterized by a temporal dimension Job functions may have limited or periodic time duration There may be activation dependencies among roles Elisa Bertino Purdue University TRBAC Main Features Periodic activations deactivations of roles Temporal dependencies among role activations deactivations ROLE TRIGGERS Elisa Bertino Purdue University TRBAC Main Features Role triggers may cause either Immediate activations deactivations or Deferred activations deactivations Run time requests to dynamically change the status of a role Elisa Bertino Purdue University TRBAC Main Features Priorities for Periodic activations deactivations Role triggers Runt time requests Priorities are used for conflict resolution Elisa Bertino Purdue University TRBAC Periodic Events Definition Periodic Event A periodic event is a tuple I P p E where I is a time interval P is a periodic expression p E is a prioritized event expression E activate R deactivate R R Roles 7 1 00 12 31 00 night time VH activate doctor on night duty 7 1 00 12 31 00 day time VH deactivate doctor on night duty Elisa Bertino Purdue University TRBAC Role Triggers Definition Role Trigger Role triggers are of the form E1 En C1 Ck p E after t where Ei s are event expressions Ei activate R deactivate R Cj s are role status expressions Cj active R not active R R Roles p E is a prioritized event expression and t is a temporal displacement Elisa Bertino Purdue University Role Triggers Example ctivate doctor on night duty ctivate nurse on day duty VH activate nurse on nigth duty H activate nurse on training after 2 Hours Elisa Bertino Purdue University Role Activation Base 1 1 00 12 31 00 night time VH activate doctor on night duty RAB Periodic Role Triggers 1 1 00 12 31 00 day time Events VH deactivate doctor on night duty 1 1 00 12 31 00 day time VH activate doctor on day duty 1 1 00 12 31 00 night time VH deactivate doctor on day duty activate doctor on night duty H activate nurse on nigth duty deactivate doctor on night duty duty activate doctor on day duty deactivate doctor on day duty activate nurse on day duty Hours Elisa Bertino deactivate nurse on day duty H deactivate nurse on nigthH activate nurse on day duty H deactivate nurse on day duty H activate nurse on training after 2 Purdue University VH deactivate nurse on training TRBAC Runtime Request Expressions Definition Runtime Request Expression A runtime request expression has the form p E after t where p E is a prioritized event expression and t is a temporal displacement deactivate nurse on training after 2 Hours activate emergency doctor Elisa Bertino Purdue University TRBAC Formal Aspects The Execution Model of a RAB specifies for each istant t the set of events that should occur at time t according to periodic events triggers in the RAB runtime request expressions priorities Elisa Bertino Purdue University TRBAC Formal Aspects Some specifications may yield no execution model while some ambiguos specifications may admit two or more models activate R activate S deactivate S deactivate R Requests activate R activate S Elisa Bertino Purdue University TRBAC Formal Aspects Safeness condition that guarantees that a given RAB has exactly one model It exploits the notion of dependency graph No cycles involving conflicting events Safeness check is polynomial in the RAB dimension Elisa Bertino Purdue University TRBAC Architectural Aspects At each time it is necessary to know which are the active roles on the basis of the RAB and runtime requests A request by a user to activate a role is authorized if The user has the authorization to play that role The role is active at the time of the request Elisa Bertino Purdue University A Possible Architecture Active Roles Events Action Handler Trigger support Actions PE DA A table which contains the Triggers It is inAcharge global records Handler Handler roles that can be activated triggers to their Theaccording activations deactivations of roles priorities If the action s table which contains It is in charge of updatingAtable caused by the trigger s Active Roles according tothe theactions to be Deferred Safeness are instantaneous it It is of activated It each is modules in charge time aItruntime of executed potentially requests the other Actions Checker It is in charge of executing request is issued If on the request is returns them to the Action managing periodic Active Roles uses table to solve potential Periodic events runtime requests deferred A table which contains the Actions actions on the for an immediate action Handler If the actions have events and it returns conflicts specified triggers triggers basis of the content of It is the activated action each toinserting deleting the time Action Handler a trigger istheif to be deferred it inserts table Deferred Actions Bertino contains anitentry themElisa into Deferred Actions inserted modified itAistable for awhich deferred corresponding to verify action whether actions inserts Purdue University for action each deferred action safeness the is preserved into into from Deferred Actions table RTR of firing event base which Handler Generalized TRBAC GTRBAC Motivations TRBAC does not distinguish between a role being enabled and a role being active A role is enabled if the temporal conditions associated with it are satisfied A role is active if a user has logged in the role Only enabled roles can be activated Because of such limitations TRBAC cannot support some forms of constraints such as the maximum number of activations of a role by a user in a given time interval Elisa Bertino Purdue University GTRBAC GTRBAC extends TRBAC by introducing temporal conditions on User role assignments Role permission assignments A large number of constraints can thus be supported Elisa Bertino Purdue University GTRBAC Examples of Constraints Constraints on the number of concurrent activations there can be at most 10 users activating the role DayDoctor at a time Constraints on the