Organisation-based Access Control

Organisation-based Access Control

In computer security, organization-based access control (OrBAC) is an access control model first presented in 2003. The current approaches of the access control rest on the three entities (subject, action, object) to control the access the policy specifies that some subject has the permission to realize some action on some object.

OrBAC allows the policy designer to define a security policy independently of the implementation. The chosen method to fulfill this goal is the introduction of an abstract level.

  • Subjects are abstracted into roles. A role is a set of subjects to which the same security rule apply.
  • Similarly, an activity is a set of actions to which the same security rule apply.
  • And, a view is a set of objects to which the same security rule apply.

Each security policy is defined for and by an organization. Thus, the specification of the security policy is completely parameterized by the organization so that it is possible to handle simultaneously several security policies associated with different organizations. The model is not restricted to permissions, but also includes the possibility to specify prohibitions and obligations. From the three abstract entities (roles, activities, views), abstract privileges are defined. And from theses abstract privileges, concrete privileges are derived.

OrBAC is context sensitive, so the policy could be expressed dynamically. Furthermore, OrBAC owns concepts of hierarchy (organization, role, activity, view, context) and separation constraints. To design and implement security policies using the OrBAC model, the MotOrBAC tool has been developed. His simulation mode can be used to test a security policy. MotOrBAC also features a conflict detection function which helps the designer to find and solve conflicts.

Read more about Organisation-based Access Control:  See Also

Famous quotes containing the words access and/or control:

    The nature of women’s oppression is unique: women are oppressed as women, regardless of class or race; some women have access to significant wealth, but that wealth does not signify power; women are to be found everywhere, but own or control no appreciable territory; women live with those who oppress them, sleep with them, have their children—we are tangled, hopelessly it seems, in the gut of the machinery and way of life which is ruinous to us.
    Andrea Dworkin (b. 1946)

    Not being able to control events, I control myself; and I adapt myself to them, if they do not adapt themselves to me.
    Michel de Montaigne (1533–1592)