Abstract:Trusted systems typically include trusted processes which possess special privileges. Such privileges can circumvent certain security checks but should be used in a controlled manner. This paper proposes a privilege control policy called DMPC (Dynamically Modified Privilege Control). It has two components: a hybrid privilege control model and a new POSIX (Port-able Operating System Interface) capability inheritance algorithm. The privilege control model in DMPC is a combination of Role Based Access Control (RBAC), Domain and Type Enforcement (DTE) and POSIX capability mechanism while the capability inheritance algorithm serves as an engine to effectively enforce the hybrid privilege control model on a secure operating system. The DMPC's design has given a high priority to supporting least privilege to a finer level of granularity on trusted systems. Additional (sub-) goals for the DMPC policy are: realizing separation of duties among privileged users, achieving separation of trusted functions from untrusted ones and providing a flexible and dynamically mediated capability mechanism. We show that RBAC alone is insufficient to enforce the principle of least privilege in a dynamic context, and that DTE and POSIX capability mechanism can successfully be conjugated with RBAC for this purpose. We also describe an implementation of the DMPC policy on a real system and report on experimental results.

Trust management with safe privilege propagation

A Task-Role Based Access Control Model with Multi-Constraints

Using trust for restricted delegation in grid environments

Anonymous authorization in trust management

A Semantic and Trust Based Framework for Rbac User-Role Assignment

Privacy Protection in Trust Management

A Constrained Role-Based Delegation Model

Trustworthiness Calculation Based on Delegation Relationship in E-service

Separation of Duty Constraint for Permission Based Delegation Model

Use Trust Management Module to Achieve Effective Security Mechanisms in Cloud Environment

Trust Management : Features and Foundations

An Authorization Delegation Model Based on User Security Levels

Dynamic Authorization Scheme Based on Delegation in Distributed System

Cross-Domain Grid Authentication and Authorization Scheme Based on Trust Management and Delegation

Research on Efficient Trust Management in Distributed Environments

An Enhanced Role-based Delegation Model

Trust Based Access Control in Infrastructure-Centric Environment

A Dynamically Modified Privilege Control Policy

Ordered Semiring-based Trust Establish Model with Risk Evaluating.

Ontort: an Ontology Model for Role-Based Trust-Management Framework

Toward trust management in autonomic and coordination applications