Abstract
This paper extends RBAC’s authorizing ability via adding domain and virtual machine features aiming at applying in the virtualized scenarios. We define a new model named VRBAC in which authorized users can migrate or copy virtual machines from one domain to another without causing a conflict. Subjects can also share permissions of not only resources but also virtual machines with other subjects from the same or different domains. Three types of conflicts in VRBAC policies are discussed and described in form of description logic, which provides extra access to reasoning engines and facilitates the conflict checking procedure. Based on Active Directory and Xen Cloud Platform, VRBAC model visualization and its conflict checking can be enforced within the prototype system. The experimental results indicate that all conflicts can be effectively detected and the literal report generated can provide conflict details such as conflict types, positions and causes as guidance for further conflict resolution.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Claycomb, W.R., Shin, D.: Detecting insider activity using enhanced directory virtualization. In: Proceedings of the 2010 ACM Workshop on Insider Threats, pp. 29–36. ACM (2010)
Hirano, M., Shinagawa, T., Eiraku, H., Hasegawa, S., Omote, K., Tanimoto, K., Horie, T., Kato, K., Okuda, T., Kawai, E.: Introducing role-based access control to a secure virtual machine monitor: security policy enforcement mechanism for distributed computers. In: IEEE Asia-Pacific Services Computing Conference, APSCC 2008, pp. 1225–1230. IEEE (2008)
Madnick, S.E., Donovan, J.J.: Application and analysis of the virtual machine approach to information system security and isolation. In: Proceedings of the Workshop on Virtual Computer Systems, pp. 210–224. ACM (1973)
Sailer, R., Jaeger, T., Valdez, E., Caceres, R., Perez, R., Berger, S., Griffin, J.L., van Doorn, L.: Building a MAC-based security architecture for the Xen open-source hypervisor. In: 21st Annual Computer Security Applications Conference, pp. 276–285. IEEE (2005)
Meushaw, R., Simard, D.: NetTop: Commercial technology in high assurance applications. Tech. Trend Notes: Preview of Tomorrow’s Information Technologies 9 (2000)
Garfinkel, T., Pfaff, B., Chow, J., Rosenblum, M., Boneh, D.: Terra: A virtual machine-based platform for trusted computing. In: ACM SIGOPS Operating Systems Review, pp. 193–206. ACM (2003)
Liu, Q., Wang, G., Weng, C., Luo, Y., Li, M.: A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security I: Theory. China Communications 7, 137–143 (2010)
Jajodia, S., Samarati, P., Subrahmanian, V.S., Bertino, E.: A unified framework for enforcing multiple access control policies. In: ACM Sigmod Record, pp. 474–485. ACM (1997)
Ferraiolo, D.F., Kuhn, D.R.: Role-based access controls. arXiv preprint arXiv:0903.2171 (2009)
Sandhu, R., Ferraiolo, D., Kuhn, R.: The NIST model for role-based access control: towards a unified standard. In: Symposium on Access Control Models and Technologies: Proceedings of the Fifth ACM Workshop on Role-Based Access Control, pp. 47–63 (2000)
Sun, Y., Wang, Q., Li, N., Bertino, E., Atallah, M.J.: On the complexity of authorization in RBAC under qualification and security constraints. IEEE Transactions on Dependable and Secure Computing 8, 883–897 (2011)
Wang, X., Gu, T., Guo, Y., Zheng, Y., Zong, J., Gong, B.: An Algorithm for Role Mapping Across Multi-domains Employing RBAC. Chinese Journal of Electronics 18 (2009)
Fan, B., Liang, X., Luo, Y., Bo, Y., Xia, C.: Conflict Detection Model of Access Control Policy in Collaborative Environment. In: 2011 International Conference on Computational and Information Sciences (ICCIS), pp. 377–381. IEEE (2011)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Luo, Y., Li, Y., Tang, Q., Wei, Z., Xia, C. (2013). VRBAC: An Extended RBAC Model for Virtualized Environment and Its Conflict Checking Approach. In: Su, J., Zhao, B., Sun, Z., Wang, X., Wang, F., Xu, K. (eds) Frontiers in Internet Technologies. Communications in Computer and Information Science, vol 401. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-53959-6_18
Download citation
DOI: https://doi.org/10.1007/978-3-642-53959-6_18
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-53958-9
Online ISBN: 978-3-642-53959-6
eBook Packages: Computer ScienceComputer Science (R0)
