- csrc home
- news & events
|RBAC book||"A must read."
Review from IEEE Computer Society, Security & Privacy
"Overall, this is a great book."
|2002 Gold Medal for Scientific/ Engineering Achievement - US Department|
|1998 Excellence in Technology Transfer Award - Federal Laboratory Consortium|
|1998 Best Paper - Nat Inf Systems Security Conf|
One of the most challenging problems in managing large networks is the complexity of security administration. Role based access control (also called role based security), as formalized in 1992 by David Ferraiolo and Rick Kuhn (pdf), has become the predominant model for advanced access control because it reduces this cost. A variety of IT vendors, including IBM, Sybase, Secure Computing, and Siemens began developing products based on this model in 1994. In 2000, the Ferraiolo-Kuhn model was integrated with the framework of Sandhu et al. (pdf) to create a unified model for RBAC, published as the NIST RBAC model (Sandhu, Ferraiolo, and Kuhn, 2000 - pdf) and adopted as an ANSI/INCITS standard in 2004. Today, most information technology vendors have incorporated RBAC into their product lines, and the technology is finding applications in areas ranging from health care to defense, in addition to the mainstream commerce systems for which it was designed. As of 2010, the majority of users in enterprises of 500 or more are now using RBAC, according to the Research Triangle Institute. For more information, please contact us at: firstname.lastname@example.org.
Economic Benefits of Role Based Access Control Analyzes economic value of RBAC for the enterprise and for the national economy, and provides quantitative economic benefits of RBAC per employee for adopting firms. Of particular interest to firms considering RBAC, report calculates savings from reduced employee downtime, more efficient provisioning, and more efficient access control policy administration, beyond the added security provided by RBAC. NIST's RBAC research was estimated to have contributed $1.1 billion in economic value. (pdf - Feb. 2011, Research Triangle Institute)
RBAC vs. ABAC - attribute based access control. ABAC is a rule-based approach to access control that can be easy to set up but complex to manage. We are investigating both practical and theoretical aspects of ABAC and similar approaches. The following papers discuss ABAC and tradeoffs in design:
E.J. Coyne, T.R. Weil, ABAC and RBAC: Scalable, Flexible, and Auditable Acces Management, IEEE IT Professional, May/June 2013. - reviews tradeoffs and characteristics of role based and attribute based approaches.
D.R. Kuhn, "Vulnerability Hierarchies in Access Control Configurations", 4th Symposium on Configuration Analytics and Automation (SAFECONFIG) 2011, IEEE.Oct. 31 – Nov. 1 Arlington, Virginia. pp. 1-9: shows that hierarchies of vulnerability detection conditions exist in ABAC rules, such that tests which detect one class of vulnerability are guaranteed to detect other classes.
D.R. Kuhn, E.J. Coyne, T.R. Weil, "Adding Attributes to Role Based Access Control", IEEE Computer, June, 2010, pp. 79-81: discusses revisions to RBAC standard being developed to combine advantages of RBAC and ABAC approaches.
CS1.1 standards update 2012 - discussing proposal for Role Based Access Control
D.F. Ferraiolo and D.R. Kuhn (1992) "Role Based Access Control" 15th National Computer Security Conference, Oct 13-16, 1992, pp. 554-563. - introduced formal model for role based access control HTML PDF.
R. S. Sandhu, E.J. Coyne, H.L. Feinstein, C.E. Youman (1996), "Role-Based Access Control Models", IEEE Computer 29(2): 38-47, IEEE Press, 1996.- proposed a framework for RBAC models PDF
Original proposal: R. Sandhu, D.F. Ferraiolo, D, R. Kuhn (2000), "The NIST Model for Role Based Access Control: Toward a Unified Standard," Postscript PDF Proceedings, 5th ACM Workshop on Role Based Access Control, July 26-27, 2000, Berlin, pp.47-63 - first public draft of the NIST RBAC model and proposal for an RBAC standard.
Current standard: American National Standard 359-2004 is the information technology industry consensus standard for RBAC. An explanation of the model used in the standard can be found in the original proposal above. The official standards document is published by ANSI INCITS.
D.F. Ferraiolo, R. Kuhn, R. Sandhu (2007), "RBAC Standard Rationale: comments on a Critique of the ANSI Standard on Role Based Access Control', IEEE Security & Privacy, vol. 5, no. 6 (Nov/Dec 2007), pp. 51-53 - PDF - explains decisions made in developing RBAC standard.
NEW: D.R. Kuhn, E.J. Coyne, T.R. Weil, "Adding Attributes to Role Based Access Control", IEEE Computer, vol. 43, no. 6 (June, 2010), pp. 79-81.
RBAC for web services standard: Web applications can use RBAC services defined by the OASIS XACML Technical Committee (see "XACML RBAC Profile"). The XACML specification describes building blocks from which an RBAC solution is constructed. A full example illustrates these building blocks. The specification then discusses how these building blocks may be used to implement the various elements of the RBAC model presented in ANSI INCITS 359-2004.
Security administration can be costly and prone to error because administrators usually specify access control lists for each user on the system individually. With RBAC, security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Security administration with RBAC consists of determining the operations that must be executed by persons in particular jobs, and assigning employees to the proper roles. Complexities introduced by mutually exclusive roles or role hierarchies are handled by the RBAC software, making security administration easier.
This web site explains
RBAC concepts, costs vs.benefits and economic impact of RBAC, design
and implementation issues, the proposed standard, and advanced research
topics. The NIST model for RBAC was adopted as an American National
Standard by the American National Standards Institute, International
Committee for Information Technology Standards (ANSI/INCITS) on
February 11, 2004. See the RBAC
Standards Section for more information.