Spatio-temporal Role Based Access Control for Physical Access Control Systems

Abstract

Due to the large size of the global enterprise and the complexity of job's functions within organisations, managing Physical Access Control (PAC) policies has become a challenging problem. It is therefore, very important to develop Access Control mechanisms that can be deployed by organizations to meet their information security needs. In this paper we first demonstrate that current Access Control models such as Spatio-Temporal Role Based Access Control (STRBAC) are not adequate for representing PAC specifications. We then discuss some of the limitations of the current models, which we highlight by conducting a case study involving the modelling of an Access Control mechanism used by a leading telecommunications company. To overcome such limitations, we present an extension of the STRBAC model which considers the physical aspects of Access Control systems. The second contribution in this paper is using our earlier method AC2Alloy to analyse PAC specifications using Alloy analyser to ensure the consistency of the specifications.