Proposed NIST standard for role-based access control

ABSTRACT

In this article we propose a standard for role-based access control (RBAC). Although RBAC models have received broad support as a generalized approach to access control, and are well recognized for their many advantages in performing large-scale authorization management, no single authoritative definition of RBAC exists today. This lack of a widely accepted model results in uncertainty and confusion about RBAC's utility and meaning. The standard proposed here seeks to resolve this situation by unifying ideas from a base of frequently referenced RBAC models, commercial products, and research prototypes. It is intended to serve as a foundation for product development, evaluation, and procurement specification. Although RBAC continues to evolve as users, researchers, and vendors gain experience with its application, we feel the features and components proposed in this standard represent a fundamental and stable set of mechanisms that may be enhanced by developers in further meeting the needs of their customers. As such, this document does not attempt to standardize RBAC features beyond those that have achieved acceptance in the commercial marketplace and research community, but instead focuses on defining a fundamental and stable set of RBAC components. This standard is organized into the RBAC Reference Model and the RBAC System and Administrative Functional Specification. The reference model defines the scope of features that comprise the standard and provides a consistent vocabulary in support of the specification. The RBAC System and Administrative Functional Specification defines functional requirements for administrative operations and queries for the creation, maintenance, and review of RBAC sets and relations, as well as for specifying system level functionality in support of session attribute management and an access control decision process.

REFERENCES

• 1: Gail-Joon Ahn , Ravi Sandhu, Role-based authorization constraints specification, ACM Transactions on Information and System Security (TISSEC), v.3 n.4, p.207-226, Nov. 2000 [doi>10.1145/382912.382913]
• 2: BALDWIN, R. W. 1990. Naming and grouping privileges to simplify security management in large databases. In Proceedings of the Symposium on Security and Privacy, IEEE Press, Los Alamitos, Calif., 116-132.
• 3: BELL,D.AND LAPADULA. 1976. Secure computer systems: Unified exposition and MULTICS. Tech. Rep. ESD-TR-75-306, The MITRE Corporation, Bedford, Mass., March.
• 4: Elisa Bertino , Piero Andrea Bonatti , Elena Ferrari, TRBAC: a temporal role-based access control model, Proceedings of the fifth ACM workshop on Role-based access control, p.21-30, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344298]
• 5: BREWER,D.AND NASH, M. 1989. The Chinese wall security policy. In Proceedings of the Symposium on Security and Privacy, IEEE Press, Los Alamitos, Calif., 215-228.
• 6: CHANDRAMOULI,R.AND SANDHU, R. 1998. Role-based access control features in commercial database management systems. In Proceedings of the NIST-NSA National (USA) Computer Security Conference, 503-511.
• 7: CLARK,D.AND WILSON, D. 1987. A comparison of commercial and military computer security policies. In proceedings of the Symposium on Security and Privacy, IEEE Press, Los Alamitos, Calif., 184-194.
• 8: Glenn Faden, RBAC in UNIX administration, Proceedings of the fourth ACM workshop on Role-based access control, p.95-101, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319180]
• 9: FEINSTEIN, H. 1996. Final report: NIST small business innovative research (SBIR) grant: Role based access control: phase 2. SETA Corp., October.
• 10: FERRAIOLO,D.AND KUHN, R. 1992. Role-based access control. In Proceedings of the NIST-NSA National (USA) Computer Security Conference, 554-563.
• 11: David F. Ferraiolo , John F. Barkley , D. Richard Kuhn, A role-based access control model and reference implementation within a corporate intranet, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.34-64, Feb. 1999 [doi>10.1145/300830.300834]
• 12: FERRAIOLO, D., CUGINI,J.,AND KUHN, R. 1995. Role-based access control: Features and motivations. In Proceedings of the Annual Computer Security Applications Conference, IEEE Press, Los Alamitos, Calif.
• 13: FERRAIOLO, D., GILBERT,D.,AND LYNCH, N. 1993. An examination of federal and commercial access control policy needs. In Proceedings of the NIST-NSA National (USA) Computer Security Conference, 107-116.
• 14: Serban I. Gavrila , John F. Barkley, Formal specification for role based access control user/role and role/role relationship management, Proceedings of the third ACM workshop on Role-based access control, p.81-90, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286902]
• 15: Luigi Giuri , Pietro Iglio, A Formal Model for Role-Based Access Control with Constraints, Proceedings of the Ninth IEEE Computer Security Foundations Workshop, p.136, March 10-12, 1996
• 16: GLIGOR, V. D., GAVRILA,S.I.,AND FERRAIOLO, D. F. 1998. On the formal definition of separation-ofduty policies and their composition. In Proceedings of the Symposium on Security and Privacy, IEEE Press, Los Alamitos, Calif.
• 17: Wei-Kuang Huang , Vijayalakshmi Atluri, SecureFlow: a secure Web-enabled workflow management system, Proceedings of the fourth ACM workshop on Role-based access control, p.83-94, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319179]
• 18: Trent Jaeger, On the increasing importance of constraints, Proceedings of the fourth ACM workshop on Role-based access control, p.33-42, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319175]
• 19: Trent Jaeger , Jonathon E. Tidswell, Rebuttal to the NIST RBAC model proposal, Proceedings of the fifth ACM workshop on Role-based access control, p.65-66, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344302]
• 20: James B. D. Joshi , Walid G. Aref , Arif Ghafoor , Eugene H. Spafford, Security models for web-based applications, Communications of the ACM, v.44 n.2, p.38-44, Feb. 2001 [doi>10.1145/359205.359224]
• 21: James Joshi , Arif Ghafoor , Walid G. Aref , Eugene H. Spafford, Digital Government Security Infrastructure Design Challenges, Computer, v.34 n.2, p.66-72, February 2001 [doi>10.1109/2.970579]
• 22: D. Richard Kuhn, Role based access control on MLS systems without kernel changes, Proceedings of the third ACM workshop on Role-based access control, p.25-32, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286890]
• 23: D. Richard Kuhn, Mutual exclusion of roles as a means of implementing separation of duty in role-based access control systems, Proceedings of the second ACM workshop on Role-based access control, p.23-30, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266749]
• 24: Butler W. Lampson, Protection, ACM SIGOPS Operating Systems Review, v.8 n.1, p.18-24, January 1974 [doi>10.1145/775265.775268]
• 25: MCCOLLUM, C., MESSING,J.,AND NOTARGIACOMO, L. 1990. Beyond the pale of MAC and DAC- Defining new forms of access control. In Proceedings of the Symposium on Security and Privacy, IEEE Press, Los Alamitos, Calif., 190-900.
• 26: Jonathan D. Moffett, Control principles and role hierarchies, Proceedings of the third ACM workshop on Role-based access control, p.63-69, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286900]
• 27: Matunda Nyanchama , Sylvia L. Osborn, Access Rights Administration in Role-Based Security Systems, Proceedings of the IFIP WG11.3 Working Conference on Database Security VII, p.37-56, August 23-26, 1994
• 28: Matunda Nyanchama , Sylvia Osborn, The role graph model and conflict of interest, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.3-33, Feb. 1999 [doi>10.1145/300830.300832]
• 29: Sylvia Osborn , Ravi Sandhu , Qamar Munawer, Configuring role-based access control to enforce mandatory and discretionary access control policies, ACM Transactions on Information and System Security (TISSEC), v.3 n.2, p.85-106, May 2000 [doi>10.1145/354876.354878]
• 30: SANDHU,R.AND BHAMIDIPATI, V. 1997. Role-based administration of user-role assignment: The URA97 model and its oracle implementation. J. Compu. Sec. 7.
• 31: Ravi Sandhu, Role activation hierarchies, Proceedings of the third ACM workshop on Role-based access control, p.33-40, October 22-23, 1998, Fairfax, Virginia, United States [doi>10.1145/286884.286891]
• 32: SANDHU, R. 1998b. Role-based access control. In Advances in Computers, vol. 46, M. Zelkowitz Eds. Academic, 237-286.
• 33: SANDHU, R. 1988. Transaction control expressions for separation of duties. In Proceedings of the Fourth Aerospace Computer Security Applications Conference (Orlando, Fla.). IEEE Computer Society Press, Dec. Los Alamitos, Calif., 282-286.
• 34: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• 35: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 36: Ravi Sandhu , David Ferraiolo , Richard Kuhn, The NIST model for role-based access control: towards a unified standard, Proceedings of the fifth ACM workshop on Role-based access control, p.47-63, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344301]
• 37: SIMON,R.AND ZURKO, R. 1997. Separation of duty in role based access control environments. In Proceedings of New Security Paradigms Workshop, (Sept.).
• 38: SMITH, C., COYNE, E., YOUMAN,C.,AND GANTA, S. 1996. Market analysis report: NIST small business innovative research (SBIR) grant: Role based access control: Phase 2. A marketing survey of civil federal government organizations to determine the need for role-based access control security product, SETA Corp., July.
• 39: THOMSEN, D. J. 1991. Role-based application design and enforcement. In Database Security, IV: Status and Prospects, S. Jajodia and C. E. Landwehr, Eds., North-Holland, 151-168.
• 40: T. C. Ting , Steven A. Demurjian , M.-Y. Hu, Requirements, Capabilities, and Functionalities of User-Role Based Security for an Object-Oriented Design Model, Results of the IFIP WG 11.3 Workshop on Database Security V: Status and Prospects, p.275-296, November 01, 1991

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Security, Standardization

Keywords:
Role-based access control, access control, authorization management, security, standards