Extending RBAC for large enterprises and its quantitative risk evaluation

Seiichi Kondo*, Mizuho Iwaihara, Masatoshi Yoshikawa, Masashi Torato


研究成果: Conference contribution

4 被引用数 (Scopus)


Systems and security products based on the RBAC model have been widely introduced to enterprises. Especially, the demands on enforcement of enterprise-level security policies and total identity management are rapidly growing. The RBAC model needs to be extended to deal with various circumstances of large enterprises, such as geographical distribution and heterogeneous environments including physical access control. In this paper, we introduce a new RBAC model, suitable for single sign-on systems. This model optimizes evaluation of rule-based RBAC so that total operation costs and productivity can be improved. Furthermore, to select most cost-effective RBAC extensions for enterprise-wide requirements, we propose a quantitative risk evaluation method based on fault trees. We construct fault trees having security violation and productivity loss as top events, and RBAC standard functions and security incidents as basic events. Probabilities of the top events are computed for given RBAC models and operation environments. We apply this method to a real enterprise system using the above RBAC extension and the proposed model realizes more safety and productivity over the base model.

ホスト出版物のタイトルTowards Sustainable Society on Ubiquitous Networks
ホスト出版物のサブタイトルThe 8th IFIP Conference on e-Business, e-Services, and e-Society (I3E 2008), September 24-16, 2008, Tokyo, Japan
編集者Makoto Oya, Ryuya Uda, Chizuko Yasunobu
出版ステータスPublished - 2008


名前IFIP International Federation for Information Processing

ASJC Scopus subject areas

  • 情報システムおよび情報管理


「Extending RBAC for large enterprises and its quantitative risk evaluation」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。