OM-AM and RBAC

1
OM-AM and RBAC

• Ravi Sandhu
• www.list.gmu.edu
• Laboratory for Information Security Technology
  (LIST)
• George Mason University

2
THE OM-AM WAY
A s s u r a n c e
What?

• Objectives
• Model
• Architecture
• Mechanism

How?
3
OM-AM AND MANDATORY ACCESS CONTROL (MAC)
A s s u r a n c e
No information leakage Lattices
(Bell-LaPadula) Security kernel Security labels
4
OM-AM AND DISCRETIONARY ACCESS CONTROL (DAC)
A s s u r a n c e
Owner-based discretion numerous numerous ACLs,
Capabilities, etc
5
OM-AM AND ROLE-BASED ACCESS CONTROL (RBAC)
A s s u r a n c e
Objective neutral RBAC96, ARBAC97,
etc. user-pull, server-pull, etc. certificates,
tickets, PACs, etc.
6
Server-Pull Architecture
Client
Server
User-role Authorization Server
7
User-Pull Architecture
Client
Server
User-role Authorization Server
8
Proxy-Based Architecture
Client
Server
Proxy Server
User-role Authorization Server