MARAH: An RBAC Model And Its IntegrationIn A Web Server

Hypermedia systems, whether implemented as web sites or not, should support security policies offering different views of the same information and different manipulation abilities to users with different needs and responsibilities in a particular context. Several experiences have demonstrated that role-based access control policies are a powerful mechanism to simplify management tasks. This paper describes the MARAH model that provides security designers with mechanisms to specify security rules using elements and abstractions of the hypermedia domain (nodes, links or contents). From a functional point of view, the model provides security designers with mechanisms to specify the rules that ensure a proper operation of any hypermedia system. Thus, one of the basic assumptions of this work is the use of abstractions belonging to the hypermedia domain in a broad sense, so that security modeling could be integrated into any hypermedia design method. Moreover, MARAH has been implemented as a module integrated into a well known web server (Apache).