A Privacy Enhanced Role-Based Access Control Model for Enterprises

• Published in: Lecture notes in computer science pp. 1012 - 1021
• Main Authors: Yang, Cungang, Zhang, Chang N.
• Format: Book Chapter Conference Proceeding
• Language: English
• Published: Berlin, Heidelberg Springer Berlin Heidelberg 2005; Springer
• Series: Lecture Notes in Computer Science
• Subjects: Access Control List; Applied sciences; Computer science; control theory; systems; Computer systems and distributed systems. User interface; Exact sciences and technology; Information Flow Control; Mandatory Access Control; Object Method; Privacy Principle; Software; Access control; Private life; Model-based reasoning; Useful information; Distributed system; Information control; Modeling; Information analysis; Data flow processing; Business model; Confidentiality; Computer security; Mobile computing; Integrity
• ISBN: 3540281029; 9783540281023
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/11534310_106

The Role-based access control (RBAC) is a super set of mandatory access control (MAC) and discretionary access control (DAC). Since MAC and DAC are useful in information flow control that protects privacy within an application, it is certainly that we can use RBAC for privacy concerns. The key benefits of the fundamental RBAC are simplified systems administration and enhanced systems security and integrity. However, it does not consider privacy protection and support controlling method invocation through argument sensitivity. In this paper, a privacy-enhanced role-based access control (PERBAC) model is proposed. Privacy related components, such as purpose, purpose hierarchy, are added to the new model. Also, an information flow analysis technique and a privacy checking algorithm are introduced to support controlling method invocation through argument sensitivity.