Towards session-aware RBAC administration and enforcement with XACML

An administrative role-based access control (AR-BAC) model specifies administrative policies over a role-based access control (RBAC) system, where an administrative permission may change an RBAC policy by updating permissions assigned to roles, or assigning/revoking users to/from roles. Conse-quently, enforcing ARBAC policies over an active access controller while some users are using pro-tected resources would result in conflicts: a policy may be in effect in the RBAC system while being updated by an ARBAC operation. Towards solv-ing this concurrency problem, we propose a session-aware administrative model for RBAC. We show how the concurrency problem can be resolved by en-hancing the eXtensible Access Control Markup Lan-guage (XACML) reference implementation. In order to do so, we develop an XACML-ARBAC profile to specify ARBAC policies, and enforce these polices by building an ARBAC enforcement module and a session administrative module. The former synchro-nizes with the evaluation of access control requests. The latter revokes conflicting ongoing user sessions immediately prior to enforcing administrative oper-ations. Experimental shows reasonable performance characteristics of our initial enhancement to Sun’s reference implementation.