Patent US6023765A successfully refreshed from Google Patents.
US6023765A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Implementation of role-based access control in multi-level secure systems
Assignee: United States Department of Commerce
•
Filing: 1997-11-20
•
Granted: 2000-02-08
•
Expires: 2017-11-20
Abstract
Abstract Role-based access control (RBAC) is implemented on an multi-level secure (MLS) system by establishing a relationship between privileges within the RBAC system and pairs of levels and compartments within the MLS system. The advantages provided by RBAC, that is, reducing the overall number of connections that must be maintained, and, for example, greatly simplifying the process required in response to a change of job status of individuals within an organization, are then realized without loss of the security provided by MLS. A trusted interface function is developed to ensure that the RBAC rules permitting individuals access to objects are followed rigorously, and provides a proper mapping of the roles to corresponding pairs of levels and compartments. No other modifications are necessary. Access requests from subjects are mapped by the interface function to pairs of levels and compartments, after which access is controlled entirely by the rules of the MLS system.
Inventors
- 👤 D. Richard Kuhn
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 22:27
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F12/00; G06F12/14; G06F12/1458; G06F12/1483; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 7
Claim 1
Independent Claim
193 words
In a lattice-based multi-level security system of the type wherein each object to which access is controlled by said lattice-based multi-level security system is assigned to a compartment and level maintained thereby, and wherein individual subjects are permitted access to specified objects protected by said security system only if the particular subject possesses a clearance level at least equal to that assigned to the object, and if the object is assigned to a compartment authorized for use by the subject, a method of implementing role-based access control, comprising the following steps: defining a collection of roles, mapping each defined role to a set of privileges, each privilege providing access to one or more combinations of compartments and levels within said lattice-based multi-level security system, assigning each subject to one or more of said roles, and at the time a subject requests access to an object, determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system, and employing said lattice-based multi-level security system to control access of the subject to the object in response to said determination.
Claim 2
Dependent Claim
193 words
In a lattice-based multi-level security system of the type wherein each object to which access is controlled by said lattice-based multi-level security system is assigned to a compartment and level maintained thereby, and wherein individual subjects are permitted access to specified objects protected by said security system only if the particular subject possesses a clearance level at least equal to that assigned to the object, and if the object is assigned to a compartment authorized for use by the subject, a method of implementing role-based access control, comprising the following steps: defining a collection of roles, mapping each defined role to a set of privileges, each privilege providing access to one or more combinations of compartments and levels within said lattice-based multi-level security system, assigning each subject to one or more of said roles, and at the time a subject requests access to an object, determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system, and employing said lattice-based multi-level security system to control access of the subject to the object in response to said determination.
Claim 3
Dependent Claim
100 words
The method of claim 1, wherein said step of determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system is performed by: (1) determining the compartment and level of the requested object within said lattice-based multi-level security system, (2) determining whether the subject belongs to a role mapped to a privilege providing access to the compartment and level of the requested object, and, if so, (3) assigning the subject access to objects having compartments and levels equal to those of the requested object.
Claim 4
Dependent Claim
52 words
The method of claim 1, comprising the further step of dividing the totality of compartments within said lattice-based multi-level security system into a first set of compartments that may be mapped to one or more of said collection of roles, and a second set of compartments that can not thus be mapped.
Claim 5
Dependent Claim
53 words
The method of claim 1, comprising the further step of dividing the totality of levels supported by said lattice-based multi-level security system into a first set of levels that may be mapped to one or more of said collection of roles, and a second set of levels that can not thus be mapped.
Claim 6
Dependent Claim
64 words
The method of claim 1, wherein as a new object is made available for access by said role-based access control method, said object is assigned to one or more compartments and levels within said lattice-based multi-level security system, and privileges providing access to said assigned compartments and levels are added to the set of privileges mapped to one or more of the defined roles.
Claim 7
Dependent Claim
179 words
The method of claim 1, wherein said step of determining whether the subject is assigned to a role having privileges corresponding to the compartment and level of the requested object within said lattice-based multi-level security system is performed by: assigning each defined role in a group of roles to a heirarchical tree, wherein a root role R 0 represents one or more privileges available to all roles in the group, and child nodes R j can access all privileges associated with role R j and any associated with roles R i , where roles R i are any ancestor nodes of R j ; associating roles at level l of the tree, where n l indicates the number of nodes at level l, with unique sets of compartments drawn from the set of remaining compartments; choosing c compartments from the remaining set of compartments and removing these c compartments from the set of compartments available to designate roles; and assigning a unique set of compartments to each privilege set at level l from the set of c compartments chosen.
References Cited (Backward Citations)
US5265221A
Cited
US5577209A
Cited
US5481700A
Cited
US5347578A
Cited
US5717755A
Cited
US5898781A
Cited
US5680452A
Cited
US5724426A
Cited
US5535383A
Cited
EP0697662A1
Cited
US5911143A
Cited
US5836011A
Cited
US5859966A
Cited
US5848232A
Cited
US5828832A
Cited
US5832228A
Cited
US5692124A
Cited
US5881225A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-02-07 | 2003-08-09 | 2004-02-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-02-07 | 2007-08-09 | 2008-02-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-02-07 | 2011-08-09 | 2012-02-08 | $7700.00 | Window Closed / Lapsed |