The NIST model for role-based access control: towards a unified standard

By R. Sandhu, David F. Ferraiolo, R. Kuhn. ACM Workshop on Role-Based Access Control, 2000

1,067 citations recorded by the source corpus.

This paper describes a unified model for role-based access control (RBAC). RBAC is a proven technology for large-scale authorization. However, lack of a standard model results in uncertainty and confusion about its utility and meaning. The NIST model seeks to resolve this situation by unifying ideas from prior RBAC models, commercial products and research prototypes. It is intended to serve as a foundation for developing future standards. RBAC is a rich and open-ended technology which is evolving as users, researchers and vendors gain experience with it. The NIST model focuses on those aspects of RBAC for which consensus is available. It is organized into four levels of increasing functional capabilities called flat RBAC, hierarchical RBAC, constrained RBAC and symmetric RBAC. These levels are cumulative and each adds exactly one new requirement. An alternate approach comprising flat and hierarchical RBAC in an ordered sequence and two unordered features—constraints and symmetry—is also presented. The paper furthermore identifies important attributes of RBAC not included in the NIST model. Some are not suitable for inclusion in a consensus document. Others require further work and agreement before standardization is feasible.

Subfields: Artificial Intelligence, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/8521dce1a21cd61d588361d8009c0671d329503e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

Citations in the corpus

The Queen's Guard: A Secure Enforcement of Fine-grained Access Control In Distributed Data Analytics Platforms (2001, background): “A first effort at defining a consensus standard for RBAC was proposed at the 2000 ACM Workshop on Role-Based Access Control [Sandhu et al. 2000].”
Access Control: Policies, Models, and Mechanisms (2000, background): “, [3,36,45,56,67,76,80]), the basic concepts are common to all approaches.”
The PERMIS X.509 role based privilege management infrastructure (2002, background): “5 More recently, research has focussed on Role Based Access Controls (RBAC) [23] [25].”
GEO-RBAC: a spatially aware RBAC (2005, methodology): “Since in location-aware applications users are often grouped in distinct categories (tourists, taxi drivers and police in the previous example) role-based access control models (RBAC models) [9, 17] represent a reasonable”
Role-based authorization constraints specification (2000, neutral): “This model has become a widely-cited authoritative reference and is the basis of a standard currently under development by the National Institute of Standards and Technology [Sandhu et al. 2000].”