A Distributed Calculus for Role-Based Access Control

Chiara Braghin, Daniele Gorla and Vladimiro Sassone

Short version in 17th IEEE Compuetr Security Foundations Workshop (CSFW '04), Pacific Grove (California, USA), June 28-30, 2004.
Full version available as Tech. Rep. 08/2004, Dip. Informatica, Univ. di Roma "La Sapienza"; part of the technical report appeared in Journal of Computer Security.

Abstract:

Role-based access control (RBAC) is increasingly attracting attention because it reduces the complexity and cost of security administration by interposing the notion of role in the assignment of permissions to users. In this paper, we present a formal framework relying on an extension of the pi-calculus to study the behavior of concurrent systems in a RBAC scenario. We define a type system ensuring that the specified policy is respected during computations, and a bisimulation to equate systems. The theory is then applied to three meaningful examples, namely finding the `minimal' policy to run a given system, refining a system to be run under a given policy (whenever possible), and minimizing the number of users in a given system without changing the overall behavior.

@InProceedings{BGS:CSFW04,
  author    =  	{C. Braghin and D. Gorla and V. Sassone},
  title     =  	{A Distributed Calculus for Role-Based Access Control},
  booktitle =   {Proc. of 17th Computer Security Foundations Workshop (CSFW'04)},
  pages     =  	{48--60},
  year      =  	{2004},
  publisher =   {IEEE Computer Society},
}

@TechReport{BGS:TR0804,
  author      =	{C. Braghin and D. Gorla and V. Sassone},
  title       = {A Distributed Calculus for Role-Based Access Control},
  institution = {Dip. Informatica, Univ. di Roma "La Sapienza"},
  year        = {2004},
  number      = {08/2004},
}