Towards an Extension of RBAC Model

Abstract

Role-based access control has been widely used in critical information systems. Access control models describe the frameworks that dictate permissions. The role-based access control (RBAC) model is generally static, that is, the access control decisions are: grant or deny. This model is effective in normal situations. In other situations, such as exceptions or emergencies, flexible access control is required. In order to increase the flexibility of access control, the concept of obligation has been proposed. Obligations are requirements to be fulfilled in order to execute permission decisions. The purpose of this article is to provide a flexible model which uses obligations to manage exception situations. This model improves the flexibility of the RBAC model. It allows to assign permissions dynamically. For this, Anderson's clinical information system is used as an illustrative example. Finally, Alloy is used to analyze the validity of the proposed model.