A generalized temporal role-based access control model

TLDR

Role‑based access control is widely used for security management, but existing temporal RBAC models only address role enabling constraints, leaving other dynamic aspects unhandled. This work introduces a generalized temporal RBAC model that can express a broader set of temporal constraints. The GTRBAC model extends TRBAC by adding periodic and duration constraints on roles, user‑role and role‑permission assignments, activation constraints such as cardinality and maximum active duration, and supports role hierarchies and separation‑of‑duty constraints.

Abstract

Role-based access control (RBAC) models have generated a great interest in the security community as a powerful and generalized approach to security management. In many practical scenarios, users may be restricted to assume roles only at predefined time periods. Furthermore, roles may only be invoked on prespecified intervals of time depending upon when certain actions are permitted. To capture such dynamic aspects of a role, a temporal RBAC (TRBAC) model has been recently proposed. However, the TRBAC model addresses the role enabling constraints only. In This work, we propose a generalized temporal role-based access control (GTRBAC) model capable of expressing a wider range of temporal constraints. In particular, the model allows expressing periodic as well as duration constraints on roles, user-role assignments, and role-permission assignments. In an interval, activation of a role can further be restricted as a result of numerous activation constraints including cardinality constraints and maximum active duration constraints. The GTRBAC model extends the syntactic structure of the TRBAC model and its event and trigger expressions subsume those of TRBAC. Furthermore, GTRBAC allows expressing role hierarchies and separation of duty (SoD) constraints for specifying fine-grained temporal semantics.