Extending RBAC for large enterprises and its quantitative risk evaluation

Seiichi Kondo*, Mizuho Iwaihara, Masatoshi Yoshikawa, Masashi Torato

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Citations (Scopus)


Systems and security products based on the RBAC model have been widely introduced to enterprises. Especially, the demands on enforcement of enterprise-level security policies and total identity management are rapidly growing. The RBAC model needs to be extended to deal with various circumstances of large enterprises, such as geographical distribution and heterogeneous environments including physical access control. In this paper, we introduce a new RBAC model, suitable for single sign-on systems. This model optimizes evaluation of rule-based RBAC so that total operation costs and productivity can be improved. Furthermore, to select most cost-effective RBAC extensions for enterprise-wide requirements, we propose a quantitative risk evaluation method based on fault trees. We construct fault trees having security violation and productivity loss as top events, and RBAC standard functions and security incidents as basic events. Probabilities of the top events are computed for given RBAC models and operation environments. We apply this method to a real enterprise system using the above RBAC extension and the proposed model realizes more safety and productivity over the base model.

Original languageEnglish
Title of host publicationTowards Sustainable Society on Ubiquitous Networks
Subtitle of host publicationThe 8th IFIP Conference on e-Business, e-Services, and e-Society (I3E 2008), September 24-16, 2008, Tokyo, Japan
EditorsMakoto Oya, Ryuya Uda, Chizuko Yasunobu
Number of pages14
Publication statusPublished - 2008
Externally publishedYes

Publication series

NameIFIP International Federation for Information Processing
ISSN (Print)1571-5736

ASJC Scopus subject areas

  • Information Systems and Management


Dive into the research topics of 'Extending RBAC for large enterprises and its quantitative risk evaluation'. Together they form a unique fingerprint.

Cite this