Abstract:Role-Based Access Control (RBAC) has been recognized as a strategy which reduces the cost and complexity of security administration in large-scale networked applications. A general family of RBAC models called RBAC96 was proposed by Sandhu et al. [1], which formally deflnes the relations among user, role and permission using the notion of set membership. Constraints is an important aspect of RBAC, which impose restrictions on acceptable conflgurations of the difierent components of RBAC. Nevertheless, it was discussed informally in the RBAC96 model. There has been some efiorts to present a logical framework for the access control models. Most of these works are based on flrst-order logic or its extensions. However, excessively rich expressiveness may bring on complex computation and confusion. We present a novel formalization of RBAC using a description logic approach. Compared with flrst-order logic, DLs achieve a better tradeofi between the computational complexity of reasoning and the expressiveness of the language. We choose the DL language ALC to represent core and hierarchical RBAC, and ALCQ that extends ALC by qualifled number restrictions to express RBAC constraints, including separation of duty and role cardinality. Based on our logical framework it is feasible to reason about RBAC and check the consistency of RBAC with constraints via a DL reasoner(e.g. RACER).

SRDL: A Simple Role-Based Delegation Logic

A Semantic and Trust Based Framework for Rbac User-Role Assignment

Using Description Logic to Formalize Role-Based Access Control Model.

An authorization framework based on constrained delegation

A Rule-Based Framework for Role-Based Constrained Delegation

Description of RBAC Delegation Model Using Ontology and SWRL

A Constrained Role-Based Delegation Model

Role-based Constrained Delegation Model and Constraints Specification

Representation for RBAC Model in Description Logic

Separation of Duty Constraint for Permission Based Delegation Model

A Delegation Logic Based AC Model for Collaborative Environment

An Enhanced Role-based Delegation Model

Dynamic Authorization Scheme Based on Delegation in Distributed System

Representation for RBAC model with description logic DL_(RBAC)

Hierarchical Role-based Restricted Delegation Model and Simulation Analyzing

Representation and reasoning on RBAC: a description logic approach

A Dynamic Description Logic-Based Formalism for RBAC

Role-based Network Dynamic Delegation Model's Research and Realization

Trust management with safe privilege propagation

Flexible Group Delegation Model Based on RBAC

Using XML to Implement Attribute-Based Delegation