Homonymous role in role-based discretionary access control

Xiaowen CHU*, Kai Ouyang, Hsiao Hwa Chen, Jiangchuan Liu, Yixin Jiang

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)

Abstract

The access control model is a core aspect of trusted information systems. Based on the role based access control (RBAC) model, we put forward the concept of the homonymous role, which extends the role control categories in RBAC, balances the control granularity and the storage space requirements, and executes the fine-grained access control. Instead of the traditional global access control policies (GACP), we propose the homonymous control domain (HCD) mechanism to enable the coexistence of multiple types of access control policies in a single system, thereby improving the control granularity and flexibility. The HCD mechanism facilitates the discretionary supporting of independent access control policies for its homonymous user. The HCD mechanism and the traditional access control mechanism can be linked to construct a two-layer access control policy mechanism for a system. Notably, we also consider the temporal characteristic in HCD, which is a critical feature of modern access control models. Furthermore, we analyze the conflicts between the HCD and GACP mechanisms. Finally, we design and implement our HCD on FreeBSD to demonstrate the advantages of the two-layer access control mechanism.

Original languageEnglish
Pages (from-to)1287-1300
Number of pages14
JournalWireless Communications and Mobile Computing
Volume9
Issue number9
DOIs
Publication statusPublished - Sep 2009

Scopus Subject Areas

  • Information Systems
  • Computer Networks and Communications
  • Electrical and Electronic Engineering

User-Defined Keywords

  • Discretionary access control
  • Homonymous role
  • Role based access control

Fingerprint

Dive into the research topics of 'Homonymous role in role-based discretionary access control'. Together they form a unique fingerprint.

Cite this