On the Modelling of the Inﬂuence of Access Control Management to the

System Security and Performance

Katarzyna Mazur

, Bogdan Ksiezopolski

1,2

and Adam Wierzbicki

Institute of Computer Science, Maria Curie-Sklodowska University, pl. M. Curie-Sklodowskiej 5, 20-031 Lublin, Poland

Polish-Japanese Academy of Information Technology, Koszykowa 86, 02-008 Warsaw, Poland

Keywords:

Security Modelling, Model-driven Engineering, Model-driven Security, Quality Of Protection, Security

Engineering, Access Control Management, RBAC.

Abstract:

To facilitate the management of permissions in complex secure systems, the concept of reference models for

role-based access control (RBAC) has been proposed. However, among many existing RBAC analyses and

implementations, there still exists the lack of the evaluation of its impact on the overall system performance. In

this paper, to reduce this deﬁciency, we introduce an initial approach towards estimation of the inﬂuence of the

most common access control mechanism on the system efﬁciency. Modelling RBAC in Quality of Protection

Modelling Language (QoP-ML), we analyse a real enterprise business scenario and report obtained results,

focusing on time and resource consumption.

1 INTRODUCTION

In large and complex network environments, a proper

security management is one of the most challeng-

ing issues to be solved. To address this problem, in

1992 David Ferraiolo and Rick Kuhn formalized a

role based access control to allow for advanced access

control management and reduce the security admin-

istration complexity. Over the years role based ac-

cess control (RBAC) fulﬁlled authors’ promises and

became a traditional access control mechanism used

widely for implementing several essential security

principles, such as least privilege, separation of duties

and data abstraction. Modelling RBAC is crucial for

many reasons. The main goals for abstracting and im-

plementing the role based access control are reduced

costs and improved security. These advantages even-

tuate primarily due to reduced cost of management

of access control and associated directory adminis-

tration. Related cost savings result from better as-

sets management (including software assets) and sim-

pliﬁed audit procedures. Furthermore, RBAC gives

excellent scalability and an organisation for secu-

rity management, providing greater granular permis-

sion control by letting administrators assigning gen-

eral permissions quickly through the use of the pre-

established roles. Security managers are able to mod-

ify and update existing roles or create specialized ones

for users with unusual requirements as needed. In-

stead of re-assigning privileges to a generous group of

users, updating the role automatically updates user’s

permissions to perform distinct tasks, saving time and

resources. Such an approach has a valuable inﬂu-

ence on simplifying secure systems administrations,

enhancing organizational productivity, system secu-

rity and integrity. Role based access control maps

consistently to the business and organizational struc-

ture of an enterprise, allowing for more understand-

able security policy deﬁnition and enforcement. Au-

tomation by using RBAC, results in system becoming

straightforward to operate and maintain and more se-

cure. Besides the obvious time (and so, indirectly, the

energy) savings and security management enhance-

ment, implementing RBAC in the enterprise has also

an enormous economic impact. Role based access

control decreases system administrator workload, re-

duces the time for introducing new policy and mini-

mizes the administrative processing time, thereby re-

ducing the cost of security management in large as

well as in small enterprises signiﬁcantly.

In role based access control approach, modelling

is an essential technology for managing the interac-

tions that occur across the complex secure systems

characterized by the high level of dynamics. It al-

lows not only for the detailed analysis of its individ-

ual components, such as roles deﬁnitions and permis-

sions assignments, but also the quantiﬁcation of the

authorization level of users allowed to perform vari-

346

Mazur K., Ksiezopolski B. and Wierzbicki A..

On the Modelling of the Inﬂuence of Access Control Management to the System Security and Performance.

DOI: 10.5220/0005378203460354

In Proceedings of the 17th International Conference on Enterprise Information Systems (ICEIS-2015), pages 346-354

ISBN: 978-989-758-097-0

 2015 SCITEPRESS (Science and Technology Publications, Lda.)

ous actions based on the scope of their assigned role.

Modelling involves considering a set of interrelated

operations within a real, existing system being mod-

elled, that interacts in many different ways, in order

to take into account the impact that the design and

operational changes on one part of the system have

on other parts.

Role based access control has been evaluated in

many contexts in a great number of research in a past

few years. Among them one can enumerate the eco-

nomic (O’Connor and Loomis, 2010) or security re-

lated studies (rba, 2010). However, to the best of

authors’ knowledge, the analysis of the inﬂuence of

the access control management on the system per-

formance seems not to be examined comprehensively

enough.

The main contribution of this paper is to model the

role based access control structure in Quality of Pro-

tection Modelling Language (Ksiezopolski, 2012b).

Such an approach allows to evaluate the inﬂuence of

role and permissions assignment on the system per-

formance. In the article we extended previous stud-

ies in the modelling of access management control

ﬁeld to a new context - the performance analysis. De-

termination of user authorization management efﬁ-

ciency being proposed here, is important because of

the proper balancing of the access control manage-

ment against the security policy, and hence the whole

system performance.

2 RELATED WORK

The major goal of the role based access control is

to simplify authorization management and review.

Having the ability of modelling various access con-

trol requirements and facilitating security administra-

tion process, RBAC became the object of the study

of many researchers. In the literature (Matulevi-

cius et al., 2011), (Sandhu et al., 1996) one can ﬁnd

plenty of RBAC implementations. Preparing RBAC

models in SecureUML (Lodderstedt et al., 2002) and

UMLsec (J¨urjens, 2005) (or any other modelling lan-

guage available) authors usually focus on its eco-

nomic or security aspects, omitting the inﬂuence of

distinct authorization levels on the system perfor-

mance. However, role based access control has an un-

deniable impact on performance and should be deter-

mined carefully in order to provide the required level

of security together with energy efﬁciency and assur-

ance of the security tradeoffs. To address this issue,

many modelling languages and tools have been pro-

posed. Among them one can enumerate UMLsec and

SecureUML presented by the researchers in (Matule-

vicius et al., 2011). Using mentioned approaches, one

is able to model and verify secure systems, either pre-

existing or those under construction. Nevertheless,

introduced solutions focus on developing secure in-

frastructure or determining system efﬁciency, rather

than examine security and performance concerns at

the same time. On one hand, the traditional approach

assumes that the implementation of the strongest se-

curity mechanisms makes the system as secure as pos-

sible. Unfortunately, such reasoning can lead to the

overestimation of security measures which causes an

unreasonable increase in the system load (Ksiezopol-

ski et al., 2009; Sklavos et al., 2006; Stubbleﬁeld

et al., 2005). The system performance is especially

important in the systems with limited resources such

as the wireless sensor networks (Mansour et al., 2014)

or the mobile devices. Another example where such

analysis should be performed is the cloud architec-

ture. The latest research indicate three main barriers

for using cloud computing which are security, per-

formance and availability (J¨urjens, 2011). When the

strongest security mechanisms are used, the system

performance decreases inﬂuencing the system avail-

ability. This tendency is particularly noticeable in

complex and distributed systems. The above state-

ment was as well proved in (B.Ksiezopolski et al.,

2011), where the authors, by analysing the perfor-

mance of the video teleconference connections tun-

nelled by VPN, evidenced that applied security mech-

anisms have impact on system performance. They

proved that when using strong encryption algorithms,

it is impossible to make the video conference of the

required quality. Another approach which conﬁrms

the above thesis is presented in (uml, 2007). The

researchers analyse different security solutions mod-

elled as aspects in UML and examine their perfor-

mance, and the utilization of both hardware and soft-

ware resources, using SSL protocol as the example.

The latest results show (Sklavos et al., 2006; Stub-

bleﬁeld et al., 2005; Mansour et al., 2014; Ksiezopol-

ski et al., 2013) that in many cases the best way is

to determine the required level of protection and ad-

just security measures to these security requirements.

(Among the means to meet these challenges one can

indicate the security metrics (Savola, 2013)). Such

approach is achieved by the means of the Quality of

Protection models where the security measures are

evaluated according to their inﬂuence on the system

security.

According to the author’s knowledge, Qual-

ity of Protection Modelling Language (QoP-ML)

(Ksiezopolski, 2012b) is the only existing modelling

language which satisﬁes all these requirements simul-

taneously. It allows for balancing security against the

OntheModellingoftheInfluenceofAccessControlManagementtotheSystemSecurityandPerformance

347

system’s efﬁciency, performing multilevel analysis of

the secure systems and extending the possibility of de-

scribing the state of the environment in detail. QoP-

ML permits to determine the required quality of pro-

tection (QoP) and adjust some of the security mea-

sures to these requirements, together with ensuring

efﬁcient system performance. This type of profound

analysis can be accomplished by the help of the Au-

tomated Quality of Protection Analysis tool (AQoPA)

(Ksiezopolski, 2012a), which allows for the evalua-

tion of the impact of every single operation deﬁned

in the prepared security model in terms of the over-

all system security. The QoP-ML consists of pro-

cesses, functions (which change system behaviour),

message channels (utilized for communication), vari-

ables (used for describing communication channels,

processes and functions and storing information about

the system or speciﬁc process), and QoP metrics (also

referred to as security metrics). The process speciﬁes

the behaviour, functions represent a single operation

or a group of operations, channels outline the environ-

ment in which the process is executed. The QoP met-

rics deﬁne the inﬂuence of functions and channels on

the quality of protection. Complete and comprehen-

sive analysis of the language (the syntax, semantics

and algorithms of the QoP-ML) is described in detail

in (Ksiezopolski, 2012b).

Since approaches presented in the literature usu-

ally speak for an example of a model driven security,

in the light of the available development methodolo-

gies, QoP-ML excellently ﬁts in a design known as

a Model-Driven Engineering. The Model-Driven En-

gineering (simply known as MDE) is meant to focus

on the creation and utilization of the abstract repre-

sentations of the knowledge that govern a particular

domain, rather than on the computing, algorithmic or

implementation concepts. Model-Driven Engineering

approach is a broader concept than Model-Driven Ar-

chitecture (MDA), or Model-Driven Security (MDS).

MDE adds multiple modelling dimensions and the

notion of a software engineering process. The vari-

ous dimensions and their intersections together with

a Domain-Speciﬁc Language (DSL) form a power-

ful framework capable of describing engineering and

maintenance processes by deﬁning the order in which

models should be produced and how they are trans-

formed into each other. Serving as a domain-speciﬁc

language, QoP-ML is capable of expressing security

models in a formalized, consistent and logical man-

ner.

3 USER ACCESS CONTROL

MANAGEMENT ANALYSIS IN

TERMS OF THE QOP-ML

In complex secure environments, aside from en-

hanced security and reduced administration costs,

system performance is another important artefact that

needs to be carefully evaluated. To improve security

management, thereby enhancing the security itself

and analyse its impact on the whole system perfor-

mance, we proposed to prepare the role based access

control in Quality of Protection Modelling Language.

Modelling a complicated enterprise infrastructure and

applying the role based access control is a challenging

task. Due to its complexity and the paper’s page lim-

itation, complete model can not be presented in detail

in the article. However, it can be downloaded from

the web page of the QoP-ML project (Ksiezopolski,

2012a). In this section, instead of introducing a com-

plex infrastructure abstraction and considering all the

possible operations, we managed to model a simple

RBAC usage example in a segment of a real-life busi-

ness situation, and evaluate its performance with the

use of the Automated Quality of Protection Analysis

tool (which can be as well downloaded from the web

page of the QoP-ML project (Ksiezopolski, 2012a)).

3.1 Scenarios

Modelling RBAC in the Quality of Protection Mod-

elling Language, we assumed the existence of an

imaginary, international banking company with cor-

porate headquarters and branches located all over

Scandinavian countries. Since the examined enter-

prise deals with employees assigned miscellaneous

responsibilities, and thus distinct permissions and

rights to the company’s assets, we took under consid-

eration three from the available enterprise roles and

determined the inﬂuence of different permissions to

the overall system performance. To emphasize and

prove role’s inﬂuence on the system’s performance,

we prepared and analysed the following scenario,

which refers to the real business situation and possible

role assignment in the actual enterprise environment.

Centralized, role-based security management sys-

tem acts as the interface between users and the whole

system. Given the enterprise network infrastructure

in Figure 1, consider having three roles: security ad-

ministrator, system operator and customer with cor-

responding security levels: high, medium and low. In

our analysis, we assumed the existence of the sys-

tem which uses a VPN tunnel encryption technology

to encrypt the trafﬁc exchanged between all the en-

terprise locations, since connecting remote ofﬁces by

ICEIS2015-17thInternationalConferenceonEnterpriseInformationSystems

348

CUSTOMER FACING

APPLICATIONS

INTERNET

INTERNAL APPLICATIONS

CORE BANKING

SYSTEM

SECURITY

CRM

CORE

NETWORK

BANK SERVICE PROVIDERS

SMARTPHONE

BANKING

APPLICATIONS

CHAT

CALL CENTER

PAYMENT

PROCESSING

ONLINE

AND

MOBILE

PAYMENT

34567890

12345678

90123456

78901234

56789012

34567890

INSURANCE

DATA CENTERS

BRANCHES

Figure 1: Example enterprise network architecture.

setting up secure VPN tunnels is the preferred way

of remote access, especially in the case of e-banking.

TLS protocols together with equivalent cryptographic

algorithms utilized in our VPN tunnels are summa-

rized in Table 1.

Table 1: TLS protocol versions together with corresponding

cryptographic algorithms.

TLS version 1

RC2 +MD5

TLS version 2

3DES/CBC + SHA-1

TLS version 3

AES/CBC 256 + SHA-512

In the examined access control method, users are

assigned to speciﬁc roles, and permissions are granted

to each role based on the user’s job requirements.

Users can be assigned any number of roles in order to

conduct day-to-day tasks. For instance, a single user

can have the access to the core banking system (being

a system administrator), as well as to payment pro-

cessing systems or customer facing applications (hav-

ing permissions of the system operator). Each role

deﬁnes permissions that are needed to access differ-

ent objects. In the proposed scenario, we consider the

users assigned customer privileges, who have the ac-

cess to the customer facing applications and use VPN

tunnel secured by TLSv1 while making the connec-

tion. At the same time, system operators dealing with

customer facing applications and payment process-

ing exchange trafﬁc with the help of the 3DES-based

VPN tunnel. Highest permissions are assigned to the

system administrator role. Person assigned this priv-

ilege set is responsible for system security, customer

relationship management system, core banking sys-

tem and has the control of the system operators ac-

tions. Prepared scenario is listed in Table 2. Here,

in Table 2 by data size we understand the amount of

the data transferred between the server and the client

during the session.

3.2 Role based Access Control Model in

QoP-ML

Examining the RBAC approach in Quality of Protec-

tion Modelling Language, we prepared the model of

the considered enterprise segment, gathered and uti-

lized real hardware security metrics and developed

appropriate versions that can be easily mapped to the

deﬁned roles.

Within our model we implemented two commu-

nicating hosts: a client and a server. The client rep-

resents the user (system administrator, system opera-

tor, or customer) (in our model referred to as role3,

role2 and role1 respectively) who needs to access

one of the enterprise servers through the VPN chan-

nel, secured by the mechanisms corresponding to the

assigned role. The server process simply manages

secure connections, serving incoming requests using

suitable TLS versions.

In addition, we prepared three asynchronous com-

munication channels to facilitate the information ex-

change process. On the client’s site, we modelled the

main process being responsible for establishing se-

cure connection with the server, and a sub-process ca-

pable of generating different types of network trafﬁc

based on the role received from the server. Server ab-

OntheModellingoftheInfluenceofAccessControlManagementtotheSystemSecurityandPerformance

349

Table 2: Scenerio deﬁned for our case study.

Scenario

❛

RBAC privileges

RBAC role

customer system operator system administrator

Application access

(single session)

FTP,

Web (WWW),

Data Center Servers

FTP,

Web (WWW),

Data Center Servers

FTP,

Web (WWW),

Data Center Servers

Data size

(for each action separately)

10MB each 10MB each 10MB each

Security mechanisms

TLSv1

(see Table 1)

TLSv2

(see Table 1)

TLSv3

(see Table 1)

stracted in Quality of Protection Modelling Language

is much alike the client - it also has a main process

which sets up the communication parameters, but, op-

posite to the client, it contains three sub-processes,

thereby being able to manage clients with miscella-

neous levels of authorization.

Using the QoP-ML’s feature called security met-

rics, we were able to determine modelled system per-

formance on a machines with the actual hardware

speciﬁcations and thus examine the hardware impact

on access control management.

It is worth noting that the ﬂexibility of the uti-

lized modelling language provides the ability to test

and simulate proposed roles one-by-oneusing the ver-

sions mechanism.

3.2.1 The Model

In this section we brieﬂy discuss all the elements

we prepared to create the role based access control

model, and analyse the results we gathered using the

Automated Quality of Protection Analysis tool. Sce-

nario (and thus the QoP-ML’s security model pre-

pared and used in our case study) can be down-

loaded from QoP-ML’s project web page (Ksiezopol-

ski, 2012a).

Listing 1: QoP-ML’s functions.

functions {

fun getRole1();

fun getRole2();

fun getRole3();

}

On listing 1, we demonstrate functions deﬁned in

the quality of protection modelling language, which

refer to the roles speciﬁed for the example enterprise.

Declared operations represent three roles: system ad-

ministrator (ﬁrst role), system operator (second role),

customer (third role). Remaining functions, referring

to the ordinary TLS operations, are omitted in the

source code presented below, as being less important

for our contribution.

Along with functions we declared some equational

rules. Same as in the case of QoP-ML functions,

deﬁned equations are not directly connected to the

speciﬁed RBAC roles.

Since one needs communication between running

processes, it is necessary to deﬁne QoP-MLs chan-

nels. As channels ch1 and ch2 are used to exchange

the TLS and actual data trafﬁc, the rbacCH is utilized

to transfer assigned RBAC role.

Listing 2: Channels used for data transfers.

channels {

channel rbacCH, ch1, ch2(0);

}

In our approach, sub-processes express operations

that may be performed by users with different RBAC

roles assigned. Client and server processes are used

to model the TLS handshake operations.

Listing 3: Client’s sub-process responsible for accessing

one of the available servers.

subprocess AccessServer(rbacCH,ch1) {

in(rbacCH:role);

if(role == role1) {

D1 = data()[10MB];

D1E = enc(D1,K1)[128,RC2,CBC];

D1MAC = hmac(D1E)[MD5];

M5 = (D1E,D1MAC);

out(ch1:M5);

}

if(role == role2) {

D1 = data()[10MB];

D1E = enc(D1,K1)[56, 3DES, CBC];

D1MAC = hmac(D1E)[SHA1];

M5 = (D1E,D1MAC);

out(ch1:M5);

}

if(role == role3) {

D1 = data()[10MB];

ICEIS2015-17thInternationalConferenceonEnterpriseInformationSystems

350

D1E = enc(D1,K1)[256, AES, CBC];

D1MAC = hmac(D1E)[SHA512];

M5 = (D1E ,D1MAC);

out(ch1:M5);

}

After deﬁning processes and sub-processes, one

can group them into

host

structures, named Client

and Server, which express the communicating sites in

the RBAC model. On the listings below, we present

a sub-process of the client who wants to connect to

one of the available servers in our scenario, as well as

the corresponding server’s code, who handles the re-

quest, according to the assigned role. Notice, that the

server handles distinct roles differently. To present

the general concept, we consider only the system ad-

ministrator management behaviour (

HandleRole3

Let us examine presented codes brieﬂy. Client’s

sub-process responsible for connection, ﬁrstly reads

the RBAC channel (

rbacCH

) to get the assigned role

from server. Depending on the obtained permis-

sion set, client has the ability to exchange (upload or

download) ﬁles of various sizes with one of the avail-

able servers. Consider the system administrator per-

missions - here, with the help of the

data

function, a

data of size

10MB

(deﬁned in the security metrics) is

created and assigned to the

variable.

Listing 4: Server’s sub-process responsible for handling

client’s requests.

subprocess HandleRole3(rbacCH,ch1) {

role3 = getRole3();

out(rbacCH:role3);

wait()[30];

in(ch1:Z);

K1E=Y[0];

D1E=Z[0];

D1MAC=Z[1];

K1=dec(K1E,SKS)[2048,RSA];

D1EVerif=hmac(D1E)[SHA512];

if (D1EVerif == D1MAC) {

D1=dec(D1E,K1)[256, AES, CBC];

}

else {

stop;

}

After that, the data is encrypted. In the follow-

ing step, the

hmac

of the encrypted message is gen-

erated and assigned to the

D1MAC

variable. Finally,

encrypted message along with its message authenti-

cation code is composed in a tuple, and sent through

the

ch1

channel to the server. Considering the server’s

sub-process handling the client’s request, one can see

that the ﬁrst instruction uses the

getRole3

QoP-ML’s

function to generate the permission set for the third

RBAC role, and then sends it through the

rbacCH

the client, using the

out

instruction. After a 30 sec-

onds long waiting time, server uses the

ch1

channel

to receive the tuple

(with the help of the

opera-

tion), consisting of the encrypted message (available

Z[0]

and assigned to the

D1E

on server’s site), to-

gether with its corresponding hmac (

Z[1]

). Later on,

the server computes its own message authentication

code on the received, encrypted message, and checks

if it is equal to the obtained one - if so, the server is

able to decrypt the message. Otherwise, it ends the

communication.

3.2.2 Security Metrics

As mentioned before, system behaviour, which is for-

mally described by the cryptographic protocol, can

also be modelled by the proposed QoP-ML. In qual-

ity of protection modelling language, the inﬂuence of

the system protection is represented by the means of

functions. During the function declaration, the quality

of protection parameters are deﬁned and details about

this function are described. These factors do not inﬂu-

ence the ﬂow of the protocol, but they are crucial for

the quality of protection analysis. During that analy-

sis, the functions QoP parameters are combined with

the next structure of QoP-ML, the security metrics.

In this structure, one can abstract the functions’ time

performance, their inﬂuence on the security attributes

required for the cryptographic protocol or other im-

portant factors during the QoP analysis. In the case of

the prepared RBAC scenario, we managed to gather

actual hardware metrics for all the security mecha-

nisms utilized in proposed TLS versions. To automate

metrics generation process, we used Crypto Metrics

Tool to measure the performance of the cryptographic

mechanisms deﬁned in our case study. Applying sta-

tistically validated and free of errors metrics, we were

able to evaluate the inﬂuence almost as thoroughly as

if we use run the simulation on a real hardware.

3.3 Results

In our estimations, we were able to perform the ac-

tual analysis for only one client accessing the server

in a single session. Remaining results were evaluated

to grow linearly, along with the number of incoming

session requests.

Consider, for instance, the customer role. Here,

the user has access to the FTP and WWW servers as

well as to the data center resources. A single session

between the client and the server can carry the trafﬁc

with the maximum size of 30MB. The communica-

tion channel is protected by the TLS protocol in ver-

sion 1 and it takes exactly 8.94 s to perform (Table

OntheModellingoftheInfluenceofAccessControlManagementtotheSystemSecurityandPerformance

351

3). Nevertheless, having identical conditions, chang-

ing only the channel protection type, time extends to

18.72 s (for system operator). As system administra-

tor is the most secure communication type example

(having other conditions equal to customer and sys-

tem operator at the same time), it is reasonable to

presume that it takes the longest time to accomplish

(36.66 s). Such analysis provides serious argumenta-

tion to believe that the assigned role can inﬂuence the

overall system performance.

However, to prove our hypothesis, we estimated

the hourly server load of the server being accessed

by users with distinct roles. Utilizing results obtained

by AQoPA along with those that have been estimated,

we evaluated the number of clients (sessions) with

different authorization permissions, the server is able

to handle within an hour. Our assessment is quite

straightforward: knowing that for the existing server,

it takes 8.94 seconds to handle user assigned role1,

and using the simplest possible formula, (1 hour =

3600 seconds, so 3600s / 8.94s ≈ 402) one can say

that within an hour server is able to deal with approx-

imately 402 clients (Figure 2).

1000

2000

3000

4000

5000

6000

7000

8000

9000

10000

Number of connected clients

Time [hours]

Server’s Performance

Role 1

Role 2

Role 3

Figure 2: Server’s performance in our scenario.

Analysing obtained results one can easily notice,

that the server is able to handle clients with the ﬁrst

authorization level faster than the same number of

clients permitted to perform system administrator ac-

tions. Gathered results clearly indicate the relation-

ship between the assigned role and consumption of

server resources: the longer time the action needs to

accomplish, the more server resources are going to

be used. A server, which works longer, utilizes more

resources, thereby consuming a greater amount of en-

ergy.

Table 3: Server’s performance results obtained by AQoPA

suggest that the assigned role matters if it comes to the sys-

tem’s performance.

Scenario

❛

Action per-

-formed (access)

RBAC role

customer

system

operator

system

administrator

FTP, Web (WWW),

Data Center

2.98s

(each)

6.24s

(each)

12.22s

(each)

Total time (full session) 8.94s 18.72s 36.66s

3.4 Discussion

The time analysis performed for the example, com-

plex IT environment can be a good start for the

research on efﬁcient CPU utilization within secure

systems. On the basis of the above examination,

we estimated the CPU load of server managing

users assigned customer, system operator and system

administrator privileges. Since the CPU load is

usually measured in percentage, we can introduce a

simpliﬁed CPU utilization formula:

U = R/C , (1)

where:

U - is the CPU utilization, expressed in percentage

R - deﬁnes our requirements, the actual busy time

of the CPU [seconds]

C - stands for the CPU capacity, the total time

spent on analysis [seconds]

The requirements speciﬁed in the above formula refer

to the time we require from the CPU to perform an

action. This time is also known as the busy time.

CPU capacity can be expressed as the sum of the busy

and idle time (that is, the total time available for the

CPU). Going simple, one can say that over a 1 minute

interval, the CPU can provide a maximum of 60 of

its seconds (power). The CPU capacity can then be

understood as busy time + idle time (the time which

was used plus the one which was left over). Using

the above simpliﬁcations, when going multi-core,

CPU capacity should be multiplied by the number of

the CPU cores (C = C · cores). In context of served

requests, the presented equation (1) can be further

detailed as follows:

load[%] =

time

session

· users

time

total

(2)

where:

ICEIS2015-17thInternationalConferenceonEnterpriseInformationSystems

352

time

session

- refers to the time the single request

took [seconds]

users - stands for the number of incoming user

connections to be managed

time

total

- is expressed as time

session

· users+time

idle

and represents the total time taken by all the han-

dled connections together with the one which was

left over

Calculating CPU load for our scenario, we as-

sumed that total analysis time is equal to 3600 sec-

onds (1 hour), and considered 90 users to be han-

dled by the server in each role. Using the (2) equa-

tion, we got about 22% of CPU load for the customer

role, approximately 46 percentage of CPU utilization

for clients using TLSv2, and roughly 92% of CPU

load for connections protected by AES and SHA-512.

Simple analysis proposed above, together with the es-

timation presented earlier, both prove that the utilized

security operations have signiﬁcant impact on overall

system performance. Introduced RBAC model brings

the opportunity to evaluate actual differences in cho-

sen security mechanisms and allows selecting the so-

lution which meets our requirements best. Going fur-

ther, performed research provide serious argumenta-

tion to believe that the reduction of the CPU usage,

and thus the amount of the utilized energy, entails

signiﬁcant economic proﬁts. Our study showed, that

ensuring required security (by switching between the

weakest and the strongest security solutions), it is pos-

sible to reduce CPU utilization, and thus, the power

consumption and increase cost savings at the same

time (dealing with exact number of incoming con-

nections). At ﬁrst glance, ﬁgures presented here may

seem irrelevant; however, when put in the context of

a large data center environment, they can quickly be-

come very signiﬁcant.

4 CONCLUSIONS

In the article we used Quality of Protection Modelling

Language to prepare the model of example business

scenario for the enterprise having role based access

control management implemented. We deﬁned two

distinct scenarios with dissimilar levels of security,

and investigated the performance of the server han-

dling miscellaneous number of users with different

RBAC roles assigned. On the basis of the gathered

results, we indicated that the user access control man-

agement has a meaningful impact on overall system’s

performance. Our research proved that drawing at-

tention to the system’s efﬁciency while implementing

the role based access control policy is crucial from the

user access control point of view, usability and secu-

rity management. Furthermore, the ability of prepar-

ing the access control management security model in

Quality of Protection Modelling Language, conﬁrmed

its extensibility and ﬂexibility with the role based ac-

cess control functionality.

ACKNOWLEDGEMENTS

This work is supported by Polish National Science

Centre grant 2012/05/B/ST6/03364

REFERENCES

(2007). Performance Analysis of Security Aspects in UML

Models. Proceedings of the 6th International Work-

shop on Software and Performance.

(2010). A Comparison of Security Analysis Techniques

for RBAC Models. Proceedings of the 2nd Annual

CCWIC.

B.Ksiezopolski, Z.Kotulski, and P.Szalachowski (2011).

On qop method for ensuring availability of the goal

of cryptographic protocols in the real-time systems.

pages 195–202. European Teletrafﬁc Seminar.

J¨urjens, J. (2005). Secure System Development with UML.

Springer.

J¨urjens, J. (2011). Security and compliance in clouds. In Se-

curity and Compliance in Clouds. 4th Pan-European

Conference, IT-Compliance.

Ksiezopolski, B. (2012a). The ofﬁcial web page of the qop-

ml project.

Ksiezopolski, B. (2012b). Qop-ml: Quality of protec-

tion modelling language for cryptographic protocols.

Computers & Security, 31:569–596.

Ksiezopolski, B., Kotulski, Z., and Szalachowski, P.

(2009). Adaptive approach to network security. CCIS,

158:233–241.

Ksiezopolski, B., Rusinek, D., and Wierzbicki, A. (2013).

On the efﬁciency modelling of cryptographic proto-

cols by means of the quality of protection modelling

language (qop-ml). LNCS, 7804:261–270.

Lodderstedt, T., Basin, D., and Doser, J. (2002). Secureuml:

A uml-based modeling language for model-driven se-

curity. LNCS, 2460:426–441.

Mansour, I., Rusinek, D., Chalhoub, G., Lafourcade, P., and

Ksiezopolski, B. (2014). Multihop node authentica-

tion mechanisms for wireless sensor networks. LNCS,

8487:402–418.

Matulevicius, R., Lakk, H., and M.Lepmets (2011). An ap-

proach to assess and compare quality of security mod-

els. ComSIS, 8.

O’Connor, A. and Loomis, R. (2010). Economic analysis of

role-based access control. National Institute of Stan-

dards and Technology.

OntheModellingoftheInfluenceofAccessControlManagementtotheSystemSecurityandPerformance

353

Sandhu, R., Coyne, E., Feinstein, H., and Youman, C.

(1996). Role-based access control models. IEEE

Computer.

Savola, R. (2013). Quality of security metrics and measure-

ments. Computers & Security, 37:78–90.

Sklavos, N., Kitsos, P., Papadopoulos, K., and

Koufopavlou, O. (2006). Design, architecture

and performance evaluation of the wireless transport

layer security. The Journal of Supercomputing,

36:33–50.

Stubbleﬁeld, A., Rubin, A., and Wallach, D. S. (2005).

Managing the performance impact of web security.

Electronic Commerce Research, 5:99–116.

ICEIS2015-17thInternationalConferenceonEnterpriseInformationSystems

354