RBAC

Role Based Access Control (RBAC) is a model for giving a user access to one or more resources.
NIST CSRC RBAC is the de facto implementation .

Introduction

RBAC is an access control mechanism which:

• Describes complex access control policies,
• Reduces errors in administration,
• Reduces cost of administration.

RBAC

Entity Relationship

The NIST RBAC Model uses a limited set of concepts to define an RBAC system as depicted below. The system has (1) users, users have (2) sessions and sessions and users have (3) roles assigned to them. Each role consist of (4) permissions and permissions are based on (5) objects and (6) operations.

The model contains 6 main entities: user: this contains all the user data session: this contains the session data for all currently logged on users role: this contains all the roles that are defined permissions: this contains all the permissions based on objects and operations object: objects are the items that require protection operation: operations are the actions that are performed on the objects

1. Model and Entity Relation taken from Mind-it .
2. Model Database: https://www.mind-it.info/wp-content/uploads/2011/06/mysql_5.txt
3. Model PHP: https://www.mind-it.info/2009/10/02/a-query-engine-for-php

Example Energy

As always an example makes more clear than anything else. Suppose we take a generic app as an example. The following fictive user and roles are defined:

User Role Harm Admin Riet Writer Jan Reader Guest Guest

Role Permission Object Admin CRUD tabHome CRUD tabInput CRUD tabAdmin Writer RU tabHome RU tabInput   tabAdmin Reader R tabHome R tabInput   tabAdmin Guest R tabHome R tabInput   tabAdmin

See also

• NIST CSC RBAC, National Institute of Standards and Technology (NIST), Computer Security Resource Center (CSRC) Role Base Access Control (RBAC) Presentation.