![](bga.png)
are dynamically assigned to roles based on a finite set
of rules. The attributes of users are the determining
factors within the rules that assign roles to users. Sev-
eral extensions to RBAC exist; temporal RBAC (TR-
BAC) has been mentioned previously. Bertino et al.
[14] propose TRBAC, which enables periodic activa-
tion and deactivation of roles and allows roles to be ei-
ther active or inactive within a certain time. They pro-
vide the syntax and semantics of TRBAC and show
an example. Various policy languages exist. Cur-
rently, eXtensible Access Control Markup Language
(XACML) (OASIS, 2005) is the XML standard ac-
cess control policy language. Knowledgable Agent-
oriented System (KAoS) (Tonti et al., 2003) enables
specification and resolution of policy conflicts where
policies are specified as an ontology. Hruby (Hruby,
2006) presents REA as a group of business patterns,
organized into two categories: operational and policy.
6 CONCLUSIONS
We describe an approach in which both business pro-
cesses and access control policies are specified us-
ing the same foundational building blocks and similar
models. As a result, the two models can be easily in-
tegrated. Access control policies are described in two
formats: the UML class diagram and a table format.
It has also been explained that the policies have the
advantage of being based on the RBAC model. In ad-
dition, we describe the RBAC model as a combination
of patterns, explained uniformly as is common in the
pattern community.
REFERENCES
Al-Kahtani, M. and Sandhu, R. (2002). A model for
attribute-based user-role assignment. In ACSAC’02,
18th Annual Computer Security Applications Confer-
ence, pages 353–364. IEEE Computer Society.
Bertino, E., Bonatti, P., and Ferrari, E. (2000). TR-
BAC: A temporal role-based access control model. In
RBAC’00, Fifth Workshop on Role-Based Access Con-
trol, pages 21–30. ACM.
Blaha, M. and Rumbaugh, J. (2005). Object-oriented Mod-
eling and Design with UML. Pearson Prentice Hall,
New Jersey, 2nd edition.
Chandramouli, R. (2000). Application of XML tools
for enterprise-wide RBAC implementation tasks. In
RBAC’00, pages 11–18. ACM.
Ferraiolo, D. and Atluri, V. (2008). A meta model for ac-
cess control: Why is it needed and is it even possi-
ble to achieve? In SACMAT’08, 13th Symposium on
Access Control Models and Technologies, pages 153–
154. ACM.
Ferraiolo, D., Kuhn, D., and Chandramouli, R. (2007).
Role-Based Access Control. Artech House, Boston,
2nd edition.
Ferraiolo, D., Sandhu, R., Gavrila, S., Kuhn, D., and Chan-
dramouli, R. (2001). Proposed NIST standard for role-
based access control. ACM Transactions on Informa-
tion and System Security, 4(3):224–274.
Finin, T., Joshi, A., Kagal, L., Niu, J., Sandhu, R., Wins-
borough, W., and Thuraisingham, B. (2008). ROWL-
BAC: Representing role based access control in OWL.
In SACMAT’08, pages 73–82. ACM.
Fowler, M. (1997). Analysis Patterns: Reusable Object
Models. Addison-Wesley, Menlo Park, California.
Geerts, G. and McCarthy, W. (2006). Policy-level specifica-
tions in REA enterprise information systems. Journal
of Information Systems, 20(2):37–63.
Hruby, P. (2006). Model-Driven Design Using Business
Patterns. Springer-Verlag, New York.
Martin, J. and Odell, J. (1998). Object-Oriented Methods: a
Foundation, UML Edition. Prentice Hall, New Jersey,
2nd edition.
OASIS (2005). eXtensible Access Control Markup Lan-
guage (XACML), Version 2.0. Organization for the
Advancement of Structured Information Standards.
OMG (2009). Unified Modeling Language (UML) Super-
structure, Version 2.2. Object Management Group.
Ray, I., Li, N., France, R., and Kim, D. (2004). Using UML
to visualize role-based access control constraints. In
SACMAT’04, pages 115–124. ACM.
Sandhu, R., Coyne, E., Feinstein, H., and Youman, C.
(1996). Role-based access control models. IEEE
Computer, 29(2):38–47.
Simon, R. and Zurko, M. (1997). Separation of duty in role-
based environments. In CSFW’97, 10th Computer Se-
curity Foundations Workshop, pages 183–194. IEEE
Computer Society.
Tonti, G., Bradshaw, J., Jeffers, R., Montanari, R., Suri, N.,
and Uszok, A. (2003). Semantic web languages for
policy representation and reasoning: A comparison
of KAoS, Rei, and Ponder. In ISWC’03, 2nd Inter-
national Semantic Web Conference, pages 419–437.
Springer.
SECRYPT 2010 - International Conference on Security and Cryptography
498