Role-based access control and the access control matrix

Gregory Saunders; Michael Hitchens; Vijay Varadharajan

doi:10.1007/978-3-540-39927-8_14

Role-based access control and the access control matrix

Gregory Saunders, Michael Hitchens, Vijay Varadharajan

School of Computing

Research output: Chapter in Book/Report/Conference proceeding › Chapter › peer-review

2 Citations (Scopus)

Abstract

The Access Matrix is a useful model for understanding the behaviour and properties of access control systems. While the matrix is rarely implemented, access control in real systems is usually based on access control mechanisms, such as access control lists or capabilities, that have clear relationships with the matrix model. In recent times a great deal of interest has been shown in Role Based Access Control (RBAC) models. However, the relationship between RBAC models and the Access Matrix is not clear. In this paper we present a model of RBAC based on the Access Matrix which makes the relationships between the two explicit. In the process of constructing this model, some fundamental similarities between certain capability models and RBAC are revealed. In particular, we outline a proof that RBAC and the ACM are equivalent with respect to the policies they can represent. From this we conclude that, in a similar way to access lists and capabilities, RBAC is a derivation of the Access Matrix model.

Original language	English
Title of host publication	Information and communications security
Subtitle of host publication	5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings
Editors	Sihan Qing, Dieter Gollmann, Jianying Zhou
Place of Publication	Heidelberg, Germany
Publisher	Springer, Springer Nature
Pages	145-157
Number of pages	13
ISBN (Electronic)	9783540399278
ISBN (Print)	9783540201502
DOIs	https://doi.org/10.1007/978-3-540-39927-8_14
Publication status	Published - 2003
Event	Fifth International Conference on Information and Communications Security - Huhehaote, China Duration: 10 Oct 2003 → 13 Oct 2003

Publication series

Name	Lecture notes in computer science
Publisher	Springer
Volume	2836
ISSN (Print)	0302-9743

Conference

Conference	Fifth International Conference on Information and Communications Security
Country/Territory	China
City	Huhehaote
Period	10/10/03 → 13/10/03

Access to Document

10.1007/978-3-540-39927-8_14

Cite this

Saunders, G., Hitchens, M., & Varadharajan, V. (2003). Role-based access control and the access control matrix. In S. Qing, D. Gollmann, & J. Zhou (Eds.), Information and communications security: 5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings (pp. 145-157). (Lecture notes in computer science; Vol. 2836). Springer, Springer Nature. https://doi.org/10.1007/978-3-540-39927-8_14

Saunders, Gregory ; Hitchens, Michael ; Varadharajan, Vijay. / Role-based access control and the access control matrix. Information and communications security: 5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings. editor / Sihan Qing ; Dieter Gollmann ; Jianying Zhou. Heidelberg, Germany : Springer, Springer Nature, 2003. pp. 145-157 (Lecture notes in computer science).

@inbook{2b1423e186054ad2b001dd50fbc59866,

title = "Role-based access control and the access control matrix",

abstract = "The Access Matrix is a useful model for understanding the behaviour and properties of access control systems. While the matrix is rarely implemented, access control in real systems is usually based on access control mechanisms, such as access control lists or capabilities, that have clear relationships with the matrix model. In recent times a great deal of interest has been shown in Role Based Access Control (RBAC) models. However, the relationship between RBAC models and the Access Matrix is not clear. In this paper we present a model of RBAC based on the Access Matrix which makes the relationships between the two explicit. In the process of constructing this model, some fundamental similarities between certain capability models and RBAC are revealed. In particular, we outline a proof that RBAC and the ACM are equivalent with respect to the policies they can represent. From this we conclude that, in a similar way to access lists and capabilities, RBAC is a derivation of the Access Matrix model.",

author = "Gregory Saunders and Michael Hitchens and Vijay Varadharajan",

year = "2003",

doi = "10.1007/978-3-540-39927-8_14",

language = "English",

isbn = "9783540201502",

series = "Lecture notes in computer science",

publisher = "Springer, Springer Nature",

pages = "145--157",

editor = "Sihan Qing and Dieter Gollmann and Jianying Zhou",

booktitle = "Information and communications security",

address = "United States",

note = "Fifth International Conference on Information and Communications Security ; Conference date: 10-10-2003 Through 13-10-2003",

}

Saunders, G, Hitchens, M & Varadharajan, V 2003, Role-based access control and the access control matrix. in S Qing, D Gollmann & J Zhou (eds), Information and communications security: 5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings. Lecture notes in computer science, vol. 2836, Springer, Springer Nature, Heidelberg, Germany, pp. 145-157, Fifth International Conference on Information and Communications Security , Huhehaote, China, 10/10/03. https://doi.org/10.1007/978-3-540-39927-8_14

Role-based access control and the access control matrix. / Saunders, Gregory; Hitchens, Michael ; Varadharajan, Vijay.
Information and communications security: 5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings. ed. / Sihan Qing; Dieter Gollmann; Jianying Zhou. Heidelberg, Germany: Springer, Springer Nature, 2003. p. 145-157 (Lecture notes in computer science; Vol. 2836).

Research output: Chapter in Book/Report/Conference proceeding › Chapter › peer-review

TY - CHAP

T1 - Role-based access control and the access control matrix

AU - Saunders, Gregory

AU - Hitchens, Michael

AU - Varadharajan, Vijay

PY - 2003

Y1 - 2003

N2 - The Access Matrix is a useful model for understanding the behaviour and properties of access control systems. While the matrix is rarely implemented, access control in real systems is usually based on access control mechanisms, such as access control lists or capabilities, that have clear relationships with the matrix model. In recent times a great deal of interest has been shown in Role Based Access Control (RBAC) models. However, the relationship between RBAC models and the Access Matrix is not clear. In this paper we present a model of RBAC based on the Access Matrix which makes the relationships between the two explicit. In the process of constructing this model, some fundamental similarities between certain capability models and RBAC are revealed. In particular, we outline a proof that RBAC and the ACM are equivalent with respect to the policies they can represent. From this we conclude that, in a similar way to access lists and capabilities, RBAC is a derivation of the Access Matrix model.

AB - The Access Matrix is a useful model for understanding the behaviour and properties of access control systems. While the matrix is rarely implemented, access control in real systems is usually based on access control mechanisms, such as access control lists or capabilities, that have clear relationships with the matrix model. In recent times a great deal of interest has been shown in Role Based Access Control (RBAC) models. However, the relationship between RBAC models and the Access Matrix is not clear. In this paper we present a model of RBAC based on the Access Matrix which makes the relationships between the two explicit. In the process of constructing this model, some fundamental similarities between certain capability models and RBAC are revealed. In particular, we outline a proof that RBAC and the ACM are equivalent with respect to the policies they can represent. From this we conclude that, in a similar way to access lists and capabilities, RBAC is a derivation of the Access Matrix model.

UR - http://www.scopus.com/inward/record.url?scp=0142187801&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-39927-8_14

DO - 10.1007/978-3-540-39927-8_14

M3 - Chapter

AN - SCOPUS:0142187801

SN - 9783540201502

T3 - Lecture notes in computer science

SP - 145

EP - 157

BT - Information and communications security

A2 - Qing, Sihan

A2 - Gollmann, Dieter

A2 - Zhou, Jianying

PB - Springer, Springer Nature

CY - Heidelberg, Germany

T2 - Fifth International Conference on Information and Communications Security

Y2 - 10 October 2003 through 13 October 2003

ER -

Saunders G, Hitchens M , Varadharajan V. Role-based access control and the access control matrix. In Qing S, Gollmann D, Zhou J, editors, Information and communications security: 5th International Conference, ICICS 2003, Huhehaote, China, October 10-13, 2003, Proceedings. Heidelberg, Germany: Springer, Springer Nature. 2003. p. 145-157. (Lecture notes in computer science). doi: 10.1007/978-3-540-39927-8_14

Role-based access control and the access control matrix

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this