Take a sneak peek at the new NIST.gov and let us know what you think!
(Please note: some content may not be complete on the beta site.).
NIST Authors in Bold
|Title:||Business Process Driven Framework for Defining an Access Control Service Based on Roles and Rules|
|Published:||October 19, 2000|
|Abstract:||Defining an Access Control Service for an enterprise application requires the choice of an access control model and a process for formulation of access decision rules to be used by the access enforcement mechanism. In this paper, we describe a business process driven framework (called the BPD-ACS) for developing both the model and formulating the access decision rules. The model used is the Role Based Access Control (RBAC) model and the access decision rules are based on temporal business associations. The enterprise setting is a multi-facility hospital and the particular application for which the access control service was defined is the Hospital-based Laboratory Information System. (HLIS).The lesson learnt from this exercise is that a much more sophisticated rule processing capability is required for these types of applications than is currently available in both commercial and research-prototype authorization servers|
|Conference:||23rd National Information Systems Security Conference (NISSC '00)|
|Proceedings:||Proceedings of the 23rd National Information Systems Security Conference (NISSC '00)|
|Dates:||October 16-19, 2000|
|Keywords:||access control models, access enforcement mechanism, enterprise security policy, information domains|
|Research Areas:||Computer Security|
|PDF version:||Click here to retrieve PDF version of paper (83KB)|