RBAC

Role Based Access Control (RBAC) is a model for giving a user access to one or more resources.
NIST CSRC RBAC is the de facto implementation

Introduction

RBAC is an access control mechanism which:

• Describes complex access control policies,
• Reduces errors in administration,
• Reduces cost of administration.

RBAC

Entity Relationship

The NIST RBAC Model uses a limited set of concepts to define an RBAC system as depicted below. The system has (1) users, users have (2) sessions and sessions and users have (3) roles assigned to them. Each role consist of (4) permissions and permissions are based on (5) objects and (6) operations.

The model contains 6 main entities: user: this contains all the user data session: this contains the session data for all currently logged on users role: this contains all the roles that are defined permissions: this contains all the permissions based on objects and operations object: objects are the items that require protection operation: operations are the actions that are performed on the objects

1) Model and Entity Relation taken from Mind-it

See also

• NIST CSC RBAC, National Institute of Standards and Technology (NIST), Computer Security Resource Center (CSRC) Role Base Access Control (RBAC) Presentation.