A Survey of Delegation from an RBAC Perspective <s> I. INTRODUCTION <s> Security administration of large systems is complex, but it can be simplified by a role-based access control approach. This article explains why RBAC is receiving renewed attention as a method of security administration and review, describes a framework of four reference models developed to better understand RBAC and categorizes different implementations, and discusses the use of RBAC to manage itself. <s> BIB001 </s> A Survey of Delegation from an RBAC Perspective <s> I. INTRODUCTION <s> We describe in more detail than before the reference model for role-based access control introduced by Nyanchama and Osborn, and the role-graph model with its accompanying algorithms, which is one way of implementing role-role relationships. An alternative role insertion algorithm is added, and it is shown how the role creation policies of Fernandez et al. correspond to role addition algorithms in our model. We then use our reference model to provide a taxonomy for kinds of conflict. We then go on to consider in some detail privilege-privilege and and role-role conflicts in conjunction with the role graph model. We show how role-role conflicts lead to a partitioning of the role graph into nonconflicting collections that can together be safely authorized to a given user. Finally, in an appendix, we present the role graph algorithms with additional logic to disallow roles that contain conflicting privileges. <s> BIB002 </s> A Survey of Delegation from an RBAC Perspective <s> I. INTRODUCTION <s> Access control models have traditionally included mandatory access control (or lattice-based access control) and discretionary access control. Subsequently, role-based access control has been introduced, along with claims that its mechanisms are general enough to simulate the traditional methods. In this paper we provide systematic constructions for various common forms of both of the traditional access control paradigms using the role-based access control (RBAC) models of Sandhu et al., commonly called RBAC96. We see that all of the features of the RBAC96 model are required, and that although for the manatory access control simulation, only one administrative role needs to be assumed, for the discretionary access control simulations, a complex set of administrative roles is required. <s> BIB003 </s> A Survey of Delegation from an RBAC Perspective <s> I. INTRODUCTION <s> Delegation, from a technical point of view, is widely considered as a potential approach in addressing the problem of providing dynamic access control decisions in activities with a high level of collaboration, either within a single security domain or across multiple security domains. Although delegation continues to attract significant attention from the research community, presently, there is no published work that presents a taxonomy of delegation concepts and models. This article intends to address this gap by presenting a set of taxonomic criteria relevant to the concept of delegation. This article also applies the taxonomy to a selection of significant delegation models published in the literature. <s> BIB004
Delegation of access rights is a very important function in the business world and in health care. As software systems attempt to support the activities of people doing their everyday tasks, so have systems, particularly access control systems, provided support for delegation. This paper provides an overview of the structural aspects of delegation, using concepts from role-based access control (RBAC) as a framework for the discussion. It complements another survey of delegation by Pham et al. BIB004 , which is less focused on RBAC and which includes implementation concepts. Access control is that part of a system which controls what users or processes can execute what operations on what objects. In computer security terminology, processes representing users, or sometimes users themselves, are referred to as subjects. Access control gives subject s the permission to execute access mode m on object o. Also important to the overall control of access to objects is user authentication, which, as the term implies, is some mechanism by which users log on to a system and are identified. Once users are authenticated and have been given some permissions to access objects, some way of verifying these accesses is required; we will call the process that verifies individual accesses to objects a reference monitor. The focus of this paper will be on delegation in access control models, and not on user authentication or reference monitors. Delegation, in turn, takes place when a more permanent access control design proves to be inadequate in some unanticipated situation. There is a broad spectrum of paradigms in access control. On the one hand we have discretionary access control (DAC), as commonly found in relational database systems and operating systems like Unix, in which objects or data are owned by a user and permission to act on them is given at the discretion of the owner. The other well-known paradigm is mandatory access control (MAC), in which access is based on labels assigned to the subject and object. Basic definitions for DAC and MAC can be found in the glossary of the orange book  . Role-based access control (RBAC) provides another way to view access control, and has been shown to be able to simulate both discretionary and mandatory access control models BIB003 . In role-based access control, users are assigned to roles, which in turn make available a set of permissions. As well as the different ways of organizing access control just discussed, there is an administrative dimension to access control. Administration can be centralized, as is implied by basic RBAC models BIB001 , BIB002 , or decentralized, as implied by the ownership concept in discretionary access control models. Also, in most systems, one can talk about design time, when requirements of different users are accounted for in the design of the system, and the time when the model is deployed and being used, which we will refer to as run time. In both of these phases of a system's life, there is a need to make available the permissions required by users to perform their tasks, or to adjust these permissions, in other words to perform administration. In the case of discretionary access control, these commands are issued by the owner of the object or by someone who has been given administrative permissions by the owner. In a security model, it may be that administrators cannot themselves perform the actions for which they are assigning permissions to others. For example, in a large company, a complex access control model could be designed so that the administrator assigning new employees to roles is someone from the human resources department, whereas the design of the permission sets of the role is performed by a security expert. Assigning a user to a role is an administrative permission; the administrator holding this administrative permission may not themselves be able to carry out the permissions made available to users assigned to the role. It may be necessary to alter the design of the access control system after it has been deployed, as the focus of the enterprise changes over time. Thus, administration can take place also at run time. Delegation, as the term is used in this paper, is motivated by a situation in which one user is temporarily unable to perform one or more of their tasks, because they are too busy, or away from their job due to illness or vacation. The user who normally has certain permissions, called the delegator, grants one or more of these permissions (or a role) to a delegatee. It is characterized by being temporary, and can be accompanied by a time limit. There are many variations to how many permissions, which permissions are delegatable, etc. which will be surveyed in this paper. Delegation is reversed by a revocation. The following points succinctly summarize the main differences between administration of access control and delegation of access control: • The assigning of permissions through administration can take place at design time when the security system is being designed, or at run time, when the security design is being updated. Assigning of permissions through delegation takes place only at run time. • The person delegating a permission also has the permission. Permissions being assigned by an administrative action can be assigned by someone not having that permission. • With delegation, the responsibility for the task remains with the delegator. With administration, the responsibility is assumed by the user receiving the permission. • Delegation is always temporary. Administratively assigned permissions remain permanently assigned until the design is updated. Many papers have been published describing delegation models. Of course, when a system designer or user of a system needs to specify a delegation, they will use the tools available to them in whatever system they are using. The purpose of this paper is to survey the many ideas that can be found in the literature regarding delegation, and to put them into a common framework so that a student or practitioner can better understand the many variations and details of delegation. The paper proceeds as follows. In Section II we discuss several uses of the term "delegation" in the literature, and arrive at the definition to be used in this paper. Section III summarizes some basic concepts of access control models which are relevant to the sections which follow it. This is followed in Section IV by the main discussion of the paper. First we list characteristics of delegation. This is followed by a detailed discussion of delegation as it can be described in the context of role-based access control. The use of constraints in specifying delegation is then discussed. Other uses of the word delegation in the literature are briefly mentioned in Section V. A summary is given in Section VI.