Implementation of role-based access control in multi-level secure systems

• US 6,023,765 A
• Filed: 11/20/1997
• Issued: 02/08/2000
• Est. Priority Date: 12/06/1996
• Status: Expired due to Fees

• Current Assignee: The United States of America As Represented By The Secretary of Commerce
• Original Assignee: THE GOVERNMENT OF THE UNITED STATES OF AMERICA, AS REPRESENTED BY THE SECRETARY OF COMMERCE
• Inventors: Kuhn, D. Richard
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Iqbal, Nadeem
• Application Number:
  US08/975,159
• Time in Patent Office: 810 Days
• Field of Search: 713/200, 713/201, 713/202, 380/3, 380/4, 380/23, 380/25, 380/29, 707/104, 707/514, 707/103, 711/163, 395/728, 395/700, 395/800
• US Class Current: 726/4
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

Role-based access control (RBAC) is implemented on an multi-level secure (MLS) system by establishing a relationship between privileges within the RBAC system and pairs of levels and compartments within the MLS system. The advantages provided by RBAC, that is, reducing the overall number of connections that must be maintained, and, for example, greatly simplifying the process required in response to a change of job status of individuals within an organization, are then realized without loss of the security provided by MLS.

A trusted interface function is developed to ensure that the RBAC rules permitting individuals access to objects are followed rigorously, and provides a proper mapping of the roles to corresponding pairs of levels and compartments. No other modifications are necessary. Access requests from subjects are mapped by the interface function to pairs of levels and compartments, after which access is controlled entirely by the rules of the MLS system.

Claims

1. In a lattice-based multi-level security system of the type wherein each object to which access is controlled by said lattice-based multi-level security system is assigned to a compartment and level maintained thereby, and wherein individual subjects are permitted access to specified objects protected by said security system only if the particular subject possesses a clearance level at least equal to that assigned to the object, and if the object is assigned to a compartment authorized for use by the subject, a method of implementing role-based access control, comprising the following steps:

defining a collection of roles,

mapping each defined role to a set of privileges, each privilege providing access to one or more combinations of compartments and levels within said lattice-based multi-level security system,

assigning each subject to one or more of said roles, and

at the time a subject requests access to an object,

determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system, and

employing said lattice-based multi-level security system to control access of the subject to the object in response to said determination.

2. The method of claim 1, wherein said step of determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system is performed by:

(1) determining the compartment and level of the requested object within said lattice-based multi-level security system,

(2) determining whether the subject belongs to a role mapped to a privilege providing access to the compartment and level of the requested object, and, if so,

(3) assigning the subject access to objects having compartments and levels equal to those of the requested object.

3. The method of claim 1, comprising the further step of dividing the totality of compartments within said lattice-based multi-level security system into a first set of compartments that may be mapped to one or more of said collection of roles, and a second set of compartments that can not thus be mapped.

4. The method of claim 1, comprising the further step of dividing the totality of levels supported by said lattice-based multi-level security system into a first set of levels that may be mapped to one or more of said collection of roles, and a second set of levels that can not thus be mapped.

5. The method of claim 1, wherein as a new object is made available for access by said role-based access control method, said object is assigned to one or more compartments and levels within said lattice-based multi-level security system, and privileges providing access to said assigned compartments and levels are added to the set of privileges mapped to one or more of the defined roles.

6. The method of claim 1, wherein said step of determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system is performed by:

assigning each defined role in a group of roles to a heirarchical tree, wherein a root role R₀ represents one or more privileges available to all roles in the group, and child nodes R_j can access all privileges associated with role R_j and any associated with roles R_i, where roles R_i are any ancestor nodes of R_j ;

associating roles at level l of the tree, where n_l indicates the number of nodes at level l, with unique sets of compartments drawn from the set of remaining compartments;

choosing c compartments from the remaining set of compartments and removing these c compartments from the set of compartments available to designate roles; and

assigning a unique set of compartments to each privilege set at level l from the set of c compartments chosen.