Role Based Access Control in Distributed Object Systems

The role-based access control (RBAC) model is widely used to make information systems secure. Even if every access request is authorized, illegal information flow might occur as the well known confinement problem. In this paper, we discuss how prevent illegal information flow to occur by synchronizing conflicting transactions in the RBAC model. We first define types of information flow relations, legal (LIF), illegal (IIF), and possibly illegal (PIF) ones R
₁
⇒ R
₂
, R
₁
↪ R
₂
, and R
₁
→ R
₂
among a pair of role families R
₁
and R
₂
, respectively. Here, let T
₁
and T
₂
be a pair of transactions with role families R
₁
and R
₂
, respectively. Suppose T
₁
precedes T
₂
in a schedule, i.e. for every pair of conflicting methods op
₁
and op
₂
from T
₁
and T2
₂
respectively, op
₁
is performed prior to op2. Here, if the LIF relation R
₁
⇒ R
₂
holds, no illegal information flow occur. If R
₁
↪ R
₂
, illegal information flow necessarily occur. R
₁
→ R2
₂
implies that illegal information flow might occur depending on in which order the transactions perform what methods.