[Paper Review] ARBAC Policy for a Large Multi-National Bank

Karthick Jayaraman, Vijay Ganesh+3 more|arXiv (Cornell University)|Oct 13, 2011

Access Control and Trust5 references3 citations

TL;DR

This paper presents a real-world case study of implementing Administrative Role-Based Access Control (ARBAC) in a large multinational bank with 18 branches, demonstrating how ARBAC's expressive features—disjunctions, positive preconditions, and mixed roles—can enforce separation of privilege (SOP) to prevent collusive fraud. The study shows that safety queries can formally verify SOP compliance, proving ARBAC's utility in complex, regulated financial environments.

ABSTRACT

Administrative role-based access control (ARBAC) is the first comprehensive administrative model proposed for role-based access control (RBAC). ARBAC has several features for designing highly expressive policies, but current work has not highlighted the utility of these expressive policies. In this report, we present a case study of designing an ARBAC policy for a bank comprising 18 branches. Using this case study we provide an assessment about the features of ARBAC that are likely to be used in realistic policies.

Motivation & Objective

• To design a scalable ARBAC policy for a large multinational bank with 18 branches and 594 roles.
• To enforce separation of privilege (SOP) in critical financial operations to prevent collusive fraud.
• To evaluate the practical utility of ARBAC's advanced features—disjunctions, positive preconditions, and mixed roles—in real-world access control policies.
• To demonstrate how safety queries can be formulated and used to formally verify policy properties before deployment.
• To provide a methodology for modeling and analyzing complex administrative access control policies in regulated financial institutions.

Proposed method

• Extended an existing RBAC policy from a European bank to 18 branches, creating a total of 594 roles across four business divisions.
• Designed a hierarchical role structure with division-level, managerial, and non-managerial roles, all inheriting from a central 'Employee' role.
• Implemented can_assign and can_revoke rules with positive and negative preconditions to enforce SOP constraints, particularly for non-managerial roles.
• Introduced helper roles (AnyFour_i and Branch_i) to encode complex analysis queries about role assignments across branches.
• Formulated safety queries as tuples ⟨u, r⟩ to verify whether a user can be assigned to a target role, enabling formal verification of SOP properties.
• Used model checkers to analyze policy safety by encoding complex access control conditions into logical rules and queries.

Experimental results

Research questions

• RQ1 How can ARBAC’s expressive features be effectively used to model and enforce separation of privilege (SOP) in a large, multi-branch financial institution?
• RQ2 What role do disjunctions, positive preconditions, and mixed roles play in expressing SOP constraints in real-world ARBAC policies?
• RQ3 How can safety queries be systematically formulated to verify complex access control properties such as multi-branch role assignment constraints?
• RQ4 To what extent do the administrative rules (can_assign and can_revoke) in ARBAC scale and remain manageable in a large, multi-national organization?
• RQ5 Can formal verification via safety queries detect violations of SOP before policy deployment in a realistic banking environment?

Key findings

• The ARBAC policy successfully enforced separation of privilege across 18 branches using disjunctions, positive preconditions, and mixed roles to prevent users from holding conflicting roles.
• The use of helper roles (AnyFour_i and Branch_i) enabled the formal encoding of complex queries about multi-branch role assignments, such as whether a user could hold four non-managerial roles in at least one or all branches.
• Safety queries of the form ⟨u, r⟩ were effective in verifying policy properties, with the target role being assigned only if the user satisfied all specified preconditions.
• The policy design demonstrated that ARBAC’s expressive features, while increasing complexity, are essential for modeling realistic security requirements like SOP in financial institutions.
• The can_assign rules for non-managerial roles were carefully crafted with combinations of positive and negative preconditions to prevent role conflicts and ensure administrative safety.
• The complete policy, including 594 can_assign and 594 can_revoke rules, was implemented and is publicly available for analysis, validating the feasibility of ARBAC in large-scale systems.