# Presentation: 345090

## RBAC in Heathcare

**RBAC in Heathcare**

- John Barkley
- RBAC Project Leader
- Software Diagnostics and Conformance Testing
- National Institute of Standards and Technology
- (301) 975-3346
- jbarkley@nist.gov
- http://hissa.nist.gov/rbac/

## Outline

_**Outline**_

-  Description of RBAC
-  NIST RBAC Model
-  Using RBAC in Healthcare
-  Access Policy Adaptive Applications

## ACTIVE PARTICIPANTS

_**ACTIVE PARTICIPANTS**_

- SDCT: Rick Kuhn, Bill Majurski,
- 	Tony Cincotta, Alan Goldfine
- CSD: Dave Ferraiolo, Doctor Ramaswamy
- 	Chandramouli
- GMU: Professor Ravi Sandhu, Jean Park
- UM: Doctor Virgil Gligor
- SETA: Ed Coyne, Ravi Sundaram (CRADA)
- VDG: Serban Gavrila (contractor)

## ROLE BASED ACCESS CONTROL (RBAC)

_**ROLE BASED ACCESS CONTROL (RBAC)**_

- RBAC is an access control mechanism which:

- Describes complex access control policies.
- Reduces errors in administration.
- Reduces cost of administration.

## NIST RBAC Activities

_**NIST RBAC Activities**_

- NIST RBAC Model (Ferraiolo, Cugini, Kuhn)
- NIST RBAC Model Implementation for the WWW
- 	(RBAC/Web)
- Administrative tools: RBAC/Web Admin Tool & RGP-Admin
- Formal description of NIST RBAC Model in PVS
- 	(software specification in mathematical language)
- Test assertions and test software
- Cost  model and role engineering tools
- Two patent applications and a provisional patent application

## INDUSTRY RECOGNITION

_**INDUSTRY RECOGNITION**_

**IBM**’s patent application for IBM RBAC model cited NIST
- 	 work as “closest prior art” (now implemented by **Tivoli**)
**Sybase** and **Secure Computing** implemented NIST  RBAC
- 	Model
**Siemens Nixdorf** implemented parts of NIST RBAC Model in
- 	Trusted Web and references our work on their Web site
- NIST RBAC Model included in **Educom** IMS Specification
- Received **1998 Excellence in Technology Transfer Award**
- 	 from **Federal Laboratory Consortium**

## Page 15 of ITL Brochure

_**Page 15 of ITL Brochure**_

***“******I would like to take this opportunity to underscore***
***the importance and relevance of research conducted***
***by your laboratory into Role-Based Access Control***
***(RBAC).  In the area of security one of the features***
***most requested by Sybase customers has been RBAC.***
***They view this feature as indispensable for the effective***
***management of large and dynamic user populations.”***

- Thomas J. Parenty
- Director, Data and Communications Security
- Sybase, Inc.
- Emeryville, Ca.

## RBAC MECHANISM

_**RBAC MECHANISM**_

- Users are associated with roles.
- Roles are associated with permissions.
- A user has a permission only if the user has an
- 	authorized role which is associated with
- 	that permission.

## Example: The Three Musketeers 

_**Example: The Three Musketeers **_
_**(User/Permission Association)**_

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

## Example: The Three Musketeers 

_**Example: The Three Musketeers **_
_**(RBAC)**_

**Musketeer**

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

## Example: The Three Musketeers 

_**Example: The Three Musketeers **_
_**(RBAC)**_

**Musketeer**

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

## Example: The Three Musketeers 

_**Example: The Three Musketeers **_
_**(RBAC)**_

**Musketeer**

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

***palace***

***weapons***

***uniform***

- Athos

- Porthos

- Aramis

- D'Artagnan

##  For each job position, let: 

-  For all job positions,

_**Quantifying RBAC Advantage**_

- RBAC advantage

- RBAC advantage

## Example: (D’Artagnon becomes a Musketeer)

_**Example: (D’Artagnon becomes a Musketeer)**_

**Musketeer**

***palace***

***weapons***

***uniform***

- D'Artagnan

***palace***

***weapons***

***uniform***

- D'Artagnan

## NIST RBAC Model

_**NIST RBAC Model**_

-  Role Hierarchies, e.g, teller inherits employee
-  Conflict of Interest Constraints:
-  Static Separation of Duty: user cannot be 	authorized for both roles, e.g., teller and 	auditor
-  Dynamic Separation of Duty: user cannot act 	simultaneously in both roles, e.g., teller 	and account holder
-  Role Cardinality: maximum number of users 	authorized for role, e.g., branch manager

## Example: Role Hierarchy for Bank 

_**Example: Role Hierarchy for Bank **_

## Example: Bank Role/Role Associations 

_**Example: Bank Role/Role Associations **_

## RBAC Administrative Tools

_**RBAC Administrative Tools**_

-  RBAC Admin Tool: user/role and role/role 	associations (RBAC/Web, NT, RDBMS)
-  RGP-Admin: role/permission associations (NT)
-  AccessMgr: Manipulation of all features of 	Windows NT ACLs
-  Tool building with visual components
-  Role Engineering and Diagnostic Tool

## RBAC/Web Admin Tool: Main Display

_**RBAC/Web Admin Tool: Main Display**_

## RBAC/Web Admin Tool: Graphical Display

_**RBAC/Web Admin Tool: Graphical Display**_

## RBAC/Web login screen for ko

_**RBAC/Web login screen for ko**_

## RBAC/Web login screen for ko

_**RBAC/Web login screen for ko**_

## RGP-Admin: Object Access Type Window

_**RGP-Admin: Object Access Type Window**_

## RGP-Admin: Object Access Type Edit Window

_**RGP-Admin: Object Access Type Edit Window**_

## RGP-Admin: Role/Group Permission Window

_**RGP-Admin: Role/Group Permission Window**_

## Role Engineering and Diagnostic Tool: input

_**Role Engineering and Diagnostic Tool: input**_

- Number of user/permission associations: 28

## Role Engineering Tool: role/permission output

_**Role Engineering Tool: role/permission output**_

- Number of role/permission 	associations: 8

- Number of associations for 	role hierarchy: 5

## Role Engineering Tool: user/role output

_**Role Engineering Tool: user/role output**_

- Number of associations for 	role hierarchy: 5

- Number of user/role 	associations: 8

- Number of role/permission associations: 8 (previous slide)

## Using RBAC in Healthcare

_**Using RBAC in Healthcare**_

-  Objective: Assess the applicability of RBAC 	to healthcare information
-  Demonstration developed to illustrate the use 	of RBAC with patient records
-  Patient record represented as a patient record 	database object (PRDBO)

**(http://www.itl.nist.gov/div897/staff/poole/documents/nistir5820.htm)**

**(http://hissa.nist.gov/rbac/proj/introdemo.html)**

## Demonstration of Patient Information Access

_**Demonstration of Patient Information Access**_

- Entity Relationships

- Architecture

## Low Level Interface to PRDBO

_**Low Level Interface to PRDBO**_

## Role Specific Interfaces to PRDBO

_**Role Specific Interfaces to PRDBO**_

- Doctor

- Patient

**(these call the low level interface)**

## Access Policy

_**Access Policy**_

**(from: “A Strategy for Security of the Clinical Record and its Transfer”**
**	****   ****Andrew Griew, Institute for Health Informatics, Aberystwyth)**

## Implementing RBAC with Layered Objects

_**Implementing RBAC with Layered Objects**_

** ****Client Interface selects and invokes the Client’s Role Interface**
** ****Role interface provides access control which includes filters**
** ****Basic Access Methods is the interface to information **
** ****Client Interface and Basic Access Methods stay fixed**
** ****Method signatures are the same for all three classes**

****** ****semantics of access (other than access control) stay the same**

**(http://hissa.nist.gov/rbac/rbacot/titlewkshp.html)**

## RBAC with Layered Objects: Role Interfaces

** ****Access to Basic Access Methods Object restricted to Role Objects**
** ****Role Interface Methods perform access control by:**
** ****applying conditionals (access? yes/no) **
** ****filtering requests and/or responses**
** ****Policy changes dictate:**
** ****Role objects added or removed**
** ****Functionality of the Role Interface Methods change**

_**RBAC with Layered Objects: Role Interfaces**_

****** ****Client and Basic Access maintain functionality when policy changes**

## Object Access Control Model

_**Object Access Control Model**_

## Access Policy Adaptive Application

_**Access Policy Adaptive Application**_

** ****Consists of three parts: **
**	****Client, Access Policy Object, Object**
** ****Access control for Client is isolated within Access Policy Object**
** ****Access to Object restricted to Access Policy Objects**
** ****Access Policy Object built by compiling the Rules expressed in a ****	****simple scripting language**
** ****Client and Object are designed to function meaningfully when ****	****	****request and/or response transformed**

## 	        return( Object.get_PR(pid, req_elts ́ ) with EltsNotRet )

**Access Policy Object:****	****	****      ****// Replaceable Component**
**        ****PR  get_PR( in PatId pid, in ReqElts req_elts)**
**	****        ****raises (InvldID, UnkwnElts, EltsNotRet)**
**	****{  req_elts ́ = <Apply Access Policy Rules>**
**	****    ****if ( req_elts ́ ********  req_elts)  then**
**	****        ****return( Object.get_PR(pid,** **req_elts ́ ) with EltsNotRet )**
**	****           ****else   return( Object.get_PR(pid,** **req_elts ) )**
**	****   ****}**
**Object:****	****PR  get_PR( in PatId pid, in ReqElts req_elts)**
**	****	****raises (InvldID, UnkwnElts, NoAccess)**
**	**

_**APAA Example: Patient Record**_

## RBAC in Healthcare: Project Conclusions

_**RBAC in Healthcare: Project Conclusions**_

** ****By itself, RBAC does not meet healthcare access control needs**
** ****Role metaphor is natural to administrators **
** ****Access policy changes faster than applications and IDL**
** ****Healthcare applications should be designed to be easily ****	****modified when access policy changes**
** ****In addition to yes/no response, an access control mechanism ****	****should be able to respond “yes, but not entirely”**
** ****A simple compiled scripting language is needed to express ****	****access policy**

****** ****Access control isolated from rest of application**

****** ****Filtering requests/responses as an access control tool ****	****	****provides applications greater opportunity to ****	****	****continue meaningful functionality**** **

****** ****RBAC fits well in healthcare**

## Web Sites

_**Web Sites**_

**The main RBAC Web Site is:**
**	****http://hissa.nist.gov/rbac**
**RBAC/Web, the RBAC implementation for World Wide Web is available at:**
**	****http://hissa.nist.gov/RBACdist/**
**The RBAC/Web Admin Tool can be tried at:**
**	****http://queeg.ncsl.nist.gov/RBACadminCGI/get_domain**
**Windows NT Tools are at:**
**	****http://hissa.nist.gov/RBACdistNT/**