Role-based access control for boxed ambients

Adriana Compagnoni, Elsa L. Gunter, Philippe Bidinger

Research output: Contribution to journalArticlepeer-review


Our society is increasingly moving towards richer forms of information exchange where mobility of processes and devices plays a prominent role. This tendency has prompted the academic community to study the security problems arising from such mobile environments, and in particular, the security policies regulating who can access the information in question. In this paper we describe a calculus for mobile processes and propose a mechanism for specifying access privileges based on a combination of the identity of the users seeking access, their credentials, and the location from which they seek it, within a reconfigurable nested structure. We define BACIR, a boxed ambient calculus extended with a Distributed Role-Based Access Control mechanism where each ambient controls its own access policy. A process in BACIR is associated with an owner and a set of activated roles that grant permissions for mobility and communication. The calculus includes primitives to activate and deactivate roles. The behavior of these primitives is determined by the process's owner, its current location and its currently activated roles. We consider two forms of security violations that our type system prevents: (1) attempting to move into an ambient without having the authorizing roles granting entry activated and (2) trying to use a communication port without having the roles required for access activated. We accomplish (1) and (2) by giving a static type system, an untyped transition semantics, and a typed transition semantics. We then show that a well-typed program never violates the dynamic security checks.

Original languageEnglish (US)
Pages (from-to)203-216
Number of pages14
JournalTheoretical Computer Science
Issue number1-3
StatePublished - May 28 2008


  • Access control
  • Ambients
  • Mobile computing
  • Process calculi
  • RBAC
  • Security
  • Type systems
  • Types

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Role-based access control for boxed ambients'. Together they form a unique fingerprint.

Cite this