Future Directions in Role-Based Access Control Models

  • Ravi Sandhu
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2052)


In the past five years there has been tremendous activity in role-based access control (RBAC) models. Consensus has been achieved on a standard core RBAC model that is in process of publication by the US National Institute of Standards and Technology (NIST). An early insight was that RBAC cannot be encompassed by a single model since RBAC concepts range from very simple to very sophisticated. Hence a family of models is more appropriate than a single model. The NIST model reflects this approach. In fact RBAC is an open-ended concept which can be extended in many different directions as new applications and systems arise. The consensus embodied in the NIST model is a substantial achievement. All the same it just a starting point. There are important aspects of RBAC models, such as administration of RBAC, on which consensus remains to be reached. Recent RBAC models have studied newer concepts such as delegation and personalization, which are not captured in the NIST model. Applications of RBAC in workflow management systems have been investigated by several researchers. Research on RBAC systems that cross organizational boundaries has also been initiated. Thus RBAC models remain a fertile area for future research. In this paper we discuss some of the directions which we feel are likely to result in practically useful enhancements to the current state of art in RBAC models.


Access Control Access Control Model RBAC Model Mandatory Access Control Springer LNCS 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Gail Ahn and Ravi Sandhu: Role-Based Authorization Constraints Specification. ACM Trans. on Information and System Security, V. 3,No 4 (November 2000)Google Scholar
  2. 2.
    Ezedin Barka and Ravi Sandhu: Framework for Role-Based Delegation Models. Proc. 16th Annual Computer Security Applications Conference, New Orleans (Dec., 2000)Google Scholar
  3. 3.
    Bertino, E., Bonatti, P., and Ferrari, E.: TRBAC: A Temporal Role-Based Access Control Model. ACM Transactions on Info. and System Security, 4:3, (Aug. 2001) to appearGoogle Scholar
  4. 4.
    Damianou, N., Dulay, N., Lupu, E., and Sloman, M.: The Ponder Policy Specification Language. Int. Workshop on Policy, Jan. 2001, Springer LNCS 1995Google Scholar
  5. 5.
    Ferraiolo, D. and Kuhn, R.: Role-Based Access Control. In Proc. of the NIST-NSA National Computer Security Conference. (1992) 554–563Google Scholar
  6. 6.
    Ferraiolo, D.F., Sandhu, R., Gavrila, D., Kuhn, D.R. and Chandramouli, R.: A Proposed Standard for Role-Based Access Control. ACM Transactions on Information and System Security, V. 4,No 3, (August 2001) to appearGoogle Scholar
  7. 7.
    Herzberg, A., Mass, Y., Mihaeli, J., Naor, D. and Ravid, Y.: Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers. IEEE Symposium on Security and Privacy, Oakland (May 2000)Google Scholar
  8. 8.
    Hildmann, T. and Barholdt, J.: Managing trust between collaborating companies using outsourced role based access control. In Proc. of 4th ACM Workshop on Role-Based Access Control. 1999 (105–111)Google Scholar
  9. 9.
    Hitchens, M. and Varadharajan, V.: Tower: A Language for Role Based Access Control. Int. Workshop on Policy, Bristol, UK, January 2001, Springer LNCS 1995Google Scholar
  10. 10.
    Huang, W., and Atluri, V.: A secure web-based workflow management system. In Proc. of 4th ACM Workshop on Role-Based Access Control. (1999)Google Scholar
  11. 11.
    Jaeger, T.: On the Increasing Importance of Constraints. Proc. 4th ACM Workshop on Role-Based Access Control, Fairfax, Virginia (Oct. 28–29, 1999) 33–42Google Scholar
  12. 12.
    Jaeger, T. and Tidswell, J.: Rebuttal to the NIST RBAC model proposal. Proc. 5th ACM Workshop on Role-Based Access Control, Berlin, Germany. (July 26–28, 2000) 65–66Google Scholar
  13. 13.
    Osborn, S., Sandhu, R. and Munawer, Q.: Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies. ACM Trans. on Information and System Security, V. 3,No 2, (May 2000) 85–106CrossRefGoogle Scholar
  14. 14.
    Sandhu, R., Coyne, E., Feinstein, H. and Youman, C.: Role-Based Access Control Models. IEEE Computer, V. 29,No 2. (Feb. 1996) 38–47Google Scholar
  15. 15.
    Sandhu, R.: Role Activation Hierarchies. Proc. 3rd ACM Workshop on Role-Based Access Control, Fairfax, Virginia. (October 22–23, 1998) 33–40Google Scholar
  16. 16.
    Sandhu, R., Bhamidipati, V. and Munawer, Q.: The ARBAC97 Model for Role-Based Administration of Roles. ACM Trans. on Info. and System Security, 2:1, (Feb. 99) 105–135Google Scholar
  17. 17.
    Sandhu, R.: Engineering Authority and Trust in Cyberspace: The OM-AM and RBAC Way. Proc. 5th ACM Workshop on RBAC, Berlin. (July 26–28, 2000) 111–119Google Scholar
  18. 18.
    Sandhu, R., Ferraiolo, D. and Kuhn, R.: The NIST Model for Role-Based Access Control: Towards A Unified Standard. Proc. 5th ACM Workshop on RBAC. 47–63Google Scholar
  19. 19.
    Thomas, R. and Sandhu, R.: Task-based Authorization Controls (TBAC): Models for Active and Enterprise-Oriented Authorization Management. In Database Security XI: Status and Prospects, Chapman & Hall 1998. 262–275Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2001

Authors and Affiliations

  • Ravi Sandhu
    • 1
    • 2
  1. 1.George Mason UniversityFairfaxUSA
  2. 2.SingleSignOn.Net Inc.RestonUSA

Personalised recommendations