{"id":"https://openalex.org/W2123662741","doi":"https://doi.org/10.1109/acsac.2009.12","title":"How to Securely Break into RBAC: The BTG-RBAC Model","display_name":"How to Securely Break into RBAC: The BTG-RBAC Model","publication_year":2009,"publication_date":"2009-12-01","ids":{"openalex":"https://openalex.org/W2123662741","doi":"https://doi.org/10.1109/acsac.2009.12","mag":"2123662741"},"language":"en","primary_location":{"id":"doi:10.1109/acsac.2009.12","doi":"https://doi.org/10.1109/acsac.2009.12","is_oa":false,"landing_page_url":"https://doi.org/10.1109/acsac.2009.12","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 Annual Computer Security Applications Conference","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://repositorio-aberto.up.pt/bitstream/10216/21676/2/47235.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040081734","display_name":"Ana Ferreira","orcid":"https://orcid.org/0000-0002-0953-9411","observed_orcids":["https://orcid.org/0000-0002-0953-9411","https://orcid.org/0009-0005-6732-8240"]},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ana Ferreira","raw_affiliation_strings":["School of Computing, University of Kent, Canterbury, UK","Sch. of Comput., Univ. of Kent, Canterbury, UK#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, University of Kent, Canterbury, UK","institution_ids":["https://openalex.org/I20581793"]},{"raw_affiliation_string":"Sch. of Comput., Univ. of Kent, Canterbury, UK#TAB#","institution_ids":["https://openalex.org/I20581793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048642442","display_name":"David William Chadwick","orcid":"https://orcid.org/0000-0003-3145-055X","observed_orcids":["https://orcid.org/0000-0003-3145-055X"]},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"David Chadwick","raw_affiliation_strings":["School of Computing, University of Kent, Canterbury, UK","Sch. of Comput., Univ. of Kent, Canterbury, UK#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing, University of Kent, Canterbury, UK","institution_ids":["https://openalex.org/I20581793"]},{"raw_affiliation_string":"Sch. of Comput., Univ. of Kent, Canterbury, UK#TAB#","institution_ids":["https://openalex.org/I20581793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008961404","display_name":"Pedro Farinha","orcid":"https://orcid.org/0000-0001-9364-9391","observed_orcids":["https://orcid.org/0000-0001-9364-9391"]},"institutions":[{"id":"https://openalex.org/I4210137384","display_name":"Centre for Health Technology and Services Research","ror":"https://ror.org/0434vme59","country_code":"PT","type":"facility","lineage":["https://openalex.org/I4210137384"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Pedro Farinha","raw_affiliation_strings":["Faculty of Medicine, CINTESIS, Porto, Portugal","Fac. of Med., CINTESIS, Porto, Portugal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Medicine, CINTESIS, Porto, Portugal","institution_ids":["https://openalex.org/I4210137384"]},{"raw_affiliation_string":"Fac. of Med., CINTESIS, Porto, Portugal","institution_ids":["https://openalex.org/I4210137384"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048922185","display_name":"Ricardo Joao Cruz-Correia","orcid":"https://orcid.org/0000-0002-3764-5158","observed_orcids":["https://orcid.org/0000-0002-3764-5158"]},"institutions":[{"id":"https://openalex.org/I4210137384","display_name":"Centre for Health Technology and Services Research","ror":"https://ror.org/0434vme59","country_code":"PT","type":"facility","lineage":["https://openalex.org/I4210137384"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Ricardo Correia","raw_affiliation_strings":["Faculty of Medicine, CINTESIS, Porto, Portugal","Fac. of Med., CINTESIS, Porto, Portugal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Medicine, CINTESIS, Porto, Portugal","institution_ids":["https://openalex.org/I4210137384"]},{"raw_affiliation_string":"Fac. of Med., CINTESIS, Porto, Portugal","institution_ids":["https://openalex.org/I4210137384"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073067515","display_name":"Gansen Zao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I187400657","display_name":"South China Normal University","ror":"https://ror.org/01kq0pv72","country_code":"CN","type":"education","lineage":["https://openalex.org/I187400657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gansen Zao","raw_affiliation_strings":["School of Computer Science, South China Normal University, China","School of Computer Science, South China Normal University, Guangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, South China Normal University, China","institution_ids":["https://openalex.org/I187400657"]},{"raw_affiliation_string":"School of Computer Science, South China Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I187400657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043797936","display_name":"Rui Chilro","orcid":"https://orcid.org/0000-0001-8750-1120","observed_orcids":["https://orcid.org/0000-0001-8750-1120"]},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Rui Chilro","raw_affiliation_strings":["Service of Informatics Faculty, Nutrition and Food Sciences, Porto, Portugal","Fac. of Nutrition & Food Sci., Service of Inf., Univ. of Porto, Porto, Portugal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Service of Informatics Faculty, Nutrition and Food Sciences, Porto, Portugal","institution_ids":["https://openalex.org/I182534213"]},{"raw_affiliation_string":"Fac. of Nutrition & Food Sci., Service of Inf., Univ. of Porto, Porto, Portugal","institution_ids":["https://openalex.org/I182534213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5048190616","display_name":"Lu\u00eds Filipe Antunes","orcid":"https://orcid.org/0000-0002-9988-594X","observed_orcids":["https://orcid.org/0000-0002-9988-594X"]},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Luis Antunes","raw_affiliation_strings":["Institute of Telecommunications, Faculty of Science, Porto, Portugal","Fac. of Sci., Inst. of Telecommun., Porto, Portugal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Telecommunications, Faculty of Science, Porto, Portugal","institution_ids":["https://openalex.org/I182534213"]},{"raw_affiliation_string":"Fac. of Sci., Inst. of Telecommun., Porto, Portugal","institution_ids":["https://openalex.org/I182534213"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.5221,"has_fulltext":true,"cited_by_count":103,"citation_normalized_percentile":{"value":0.97763913,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"23","last_page":"31"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13999","display_name":"Digital Rights Management and Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/role-based-access-control","display_name":"role-based access control","score":0.9380000233650208},{"id":"https://openalex.org/keywords/access-control-models","display_name":"access control models","score":0.6980000138282776},{"id":"https://openalex.org/keywords/emergency-access","display_name":"emergency access","score":0.7229999899864197},{"id":"https://openalex.org/keywords/healthcare-data-security","display_name":"healthcare data security","score":0.6200000047683716}],"concepts":[{"id":"https://openalex.org/C45567728","wikidata":"https://www.wikidata.org/wiki/Q1702839","display_name":"Role-based access control","level":3,"score":0.9436044692993164},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.8568764925003052},{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.6971282958984375},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6821772456169128},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6721972227096558},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.6576738953590393},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.604080080986023},{"id":"https://openalex.org/C2777351106","wikidata":"https://www.wikidata.org/wiki/Q49371","display_name":"Legislation","level":2,"score":0.5945988297462463},{"id":"https://openalex.org/C100587491","wikidata":"https://www.wikidata.org/wiki/Q1474665","display_name":"Separation of duties","level":4,"score":0.46532127261161804},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.43996915221214294},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.12529563903808594},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1074565052986145},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.101939857006073},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0}],"mesh":[],"locations_count":6,"locations":[{"id":"doi:10.1109/acsac.2009.12","doi":"https://doi.org/10.1109/acsac.2009.12","is_oa":false,"landing_page_url":"https://doi.org/10.1109/acsac.2009.12","pdf_url":null,"source":{"id":"https://openalex.org/S4306417673","display_name":"Annual Computer Security Applications Conference","issn_l":"1063-9527","issn":["1063-9527","2576-9103"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 Annual Computer Security Applications Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:kar.kent.ac.uk:31989","doi":null,"is_oa":false,"landing_page_url":"https://doi.org/10.1109/ACSAC.2009.12>)","pdf_url":null,"source":{"id":"https://openalex.org/S4377196264","display_name":"Kent Academic Repository (University of Kent)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I20581793","host_organization_name":"University of Kent","host_organization_lineage":["https://openalex.org/I20581793"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Book section"},{"id":"pmh:oai:repositorio-aberto.up.pt:10216/21676","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10216/21676","pdf_url":"https://repositorio-aberto.up.pt/bitstream/10216/21676/2/47235.pdf","source":{"id":"https://openalex.org/S4306402433","display_name":"Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"book"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.251.106","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.251.106","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://kar.kent.ac.uk/31989/1/ACSACfinalSubmitted.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.528.7266","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.528.7266","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.acsac.org/2009/openconf/modules/request.php?action%3Dview.php%26id%3D135%26module%3Doc_program","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.823.7499","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.823.7499","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://repositorio-aberto.up.pt/bitstream/10216/21676/2/7155.pdf","raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:repositorio-aberto.up.pt:10216/21676","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10216/21676","pdf_url":"https://repositorio-aberto.up.pt/bitstream/10216/21676/2/47235.pdf","source":{"id":"https://openalex.org/S4306402433","display_name":"Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"book"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2123662741.pdf","grobid_xml":"https://content.openalex.org/works/W2123662741.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W607927947","https://openalex.org/W1559498407","https://openalex.org/W1601457685","https://openalex.org/W1797804927","https://openalex.org/W1971331291","https://openalex.org/W2020255359","https://openalex.org/W2032448872","https://openalex.org/W2068254409","https://openalex.org/W2106465551","https://openalex.org/W2115853608","https://openalex.org/W2121034979","https://openalex.org/W2135414215","https://openalex.org/W2142877744","https://openalex.org/W2245939083","https://openalex.org/W4252026682"],"related_works":["https://openalex.org/W2912451723","https://openalex.org/W2319059571","https://openalex.org/W2020255359","https://openalex.org/W1887209609","https://openalex.org/W2120891046","https://openalex.org/W2110470079","https://openalex.org/W7096223118","https://openalex.org/W7010310497","https://openalex.org/W2167890810","https://openalex.org/W2383594797"],"abstract_inverted_index":{"Access":[0],"control":[1,17,41],"models":[2],"describe":[3],"frameworks":[4],"that":[5,100,193],"dictate":[6],"how":[7,177],"subjects":[8],"(e.g.":[9],"users)":[10],"access":[11,16,20,40,70],"resources.":[12],"In":[13],"the":[14,26,28,32,52,57,69,89,135,155,159,165,173,178,190,210,218,221,229],"role-based":[15],"(RBAC)":[18],"model":[19,38,92,180],"to":[21,65,85,133,153,171,226],"resources":[22],"is":[23,35,84,181],"based":[24],"on":[25,56],"role":[27],"user":[29],"holds":[30],"within":[31,88,184],"organization.":[33],"RBAC":[34,91,160],"a":[36,73,94,123,185,200],"rigid":[37],"where":[39,109,189],"decisions":[42],"have":[43,213],"only":[44],"two":[45],"output":[46],"options:":[47],"grant":[48],"or":[49,67,111,158],"deny.":[50],"break":[51,66,134],"glass":[53,136],"(BTG)":[54],"policies":[55],"other":[58],"hand":[59],"are":[60],"flexible":[61],"and":[62,75,96,215],"allow":[63],"users":[64,131],"override":[68],"controls":[71],"in":[72,93,106,147,169,224],"controlled":[74],"justifiable":[76],"manner.":[77],"The":[78,116],"main":[79],"objective":[80],"of":[81,203,220],"this":[82],"paper":[83],"integrate":[86],"BTG":[87,222],"NIST/ANSI":[90],"transparent":[95],"secure":[97],"way":[98],"so":[99],"it":[101],"can":[102,143],"be":[103,139,145,197],"adopted":[104],"generically":[105],"any":[107,148],"domain":[108],"unanticipated":[110],"emergency":[112],"situations":[113],"may":[114],"occur.":[115],"new":[117],"proposed":[118],"model,":[119,174],"called":[120],"BTG-RBAC,":[121],"provides":[122],"third":[124],"decision":[125,166],"option":[126],"BTG,":[127],"which":[128],"grants":[129],"authorized":[130],"permission":[132],"rather":[137],"than":[138],"denied":[140],"access.":[141],"This":[142],"easily":[144],"implemented":[146],"application":[149,156],"without":[150],"major":[151],"changes":[152],"either":[154],"code":[157],"authorization":[161],"infrastructure,":[162],"apart":[163],"from":[164],"engine.":[167],"Finally,":[168],"order":[170,225],"validate":[172],"we":[175],"discuss":[176],"BTG-RBAC":[179],"being":[182],"introduced":[183],"Portuguese":[186],"healthcare":[187,204],"institution":[188],"legislation":[191],"requires":[192],"genetic":[194],"information":[195],"must":[196],"accessed":[198],"by":[199,209],"restricted":[201],"group":[202],"professionals.":[205],"These":[206],"professionals,":[207],"advised":[208],"ethical":[211],"committee,":[212],"required":[214],"asked":[216],"for":[217],"implementation":[219],"concept":[223],"comply":[227],"with":[228],"said":[230],"legislation.":[231]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":8},{"year":2018,"cited_by_count":6},{"year":2017,"cited_by_count":6},{"year":2016,"cited_by_count":6},{"year":2015,"cited_by_count":6},{"year":2014,"cited_by_count":11},{"year":2013,"cited_by_count":17},{"year":2012,"cited_by_count":12}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2016-06-24T00:00:00"}