CECS694 Injecting RoleBased Access Control RBAC to secure a Webbased CSULB Workflow System Midterm P

1
CECS-694 Injecting Role-Based Access Control
(RBAC) to secure a Web-based CSULB Workflow
System(Midterm Presentation)
CSULB Fall 2009

• Arthur Melnikov

2
Current CSULB Security WEB Design
Is it possible for attacker retrieve the list of
PWs and USERs info from Application
Databases? Answer YES
Hacker Attack
3
New CSULB Security WEB Design
Is it possible for attacker retrieve the list of
PWs and USERs info from Application
Database? Answer only for NONE CSULB users
Hacker Attack
4
Domain Organizational Units
123 Departments counted in CSULB
5
Role-Based Access Control
User Role - Permission relationship assignments
can be organized by two Boolean matrices UR
(USERS X ROLES) PR (PERMISSIONS X ROLES)
defined as ?UR u, r true ? u ? r ? ?PR p,
r true ? p ? r
6
RBAC Privilege

• Roles are built based on principle of least
  privileged
• Role contains the minimum amount of permissions
  to instantiate a domain
• User is assigned to a role that allows to
  perform only whats required for that role
• No single role is given more permission than
  the same role for another user

7
Role Organizational Units
Users
Roles
Resources
Users can change frequently, Roles usually dont
8
Role-Based Administration
In RBAC the concept of a session refers to the
mapping between a user and an activated subset of
roles that are assigned to the user. Each user
can be associated with one or more sessions at a
time.
9
SESSION ALGORITHMS
This algorithm let to create a new session with a
given user as owner and an active role set. The
algorithm is valid if and only if - user is a
member of the USERS data set. - active role set
is a subset of the roles assigned to that user.
10
SESSION ALGORITHMS (cont.)

• This algorithm let to delete a given session with
  a given owner user. The algorithm is valid if and
  only if
• session identifier is a member of the SESSIONS
  data set.
• user is a member of the USERS data set.
• session is owned by the given user.

11
Functional Role Hierarchy
Defined as RH ? ROLES X ROLES is inheritance
relation (?) where r1 ? r2 only if all privileges
of r2 are also permissions of r1, and all users
of r1 are also users of r2 r1 ? r2 ?
authorized_permissions(r2) ? authorized_permission
s(r1) ? authorized_users(r1) ? authorized_users(r2
)
12
Functional Role Hierarchy (cont.)
If a role A inherits role B, it means that all of
B permissions are available via role A.
13
Constraints
Conflict of interest in RBAC mechanism may
appear as a result of a user gaining
authorization for permissions associated with
conflicting roles. I am going to prevent this
form of conflict of interest is through Static
Separation of Duty (SSD) or Dynamic Separation of
Duty (FSD), that enforce constraints on the
assignment of users to roles or sessions to
roles.
14
RBAC Transition
Least Privileged Separation of Duties
Most Complex
15
RBAC Administration Tool
Resources
16
Implementation Example
User admin_at_csulb.edu has the System Admin
privileges only for Child Development Family
Studies department domain http//cdfs.csulb.edu
17
Thank you!Questions?