The ARBAC97 model for role-based administration of roles

TLDR

Role‑based access control assigns permissions to roles and users to those roles to simplify authorization, and the idea of using RBAC to administer itself offers further convenience and scalability, with the foundational components URA97, PRA97, and RRA97 defined in 1997–1998. This paper describes the motivation, intuition, and formal definition of a new role‑based model for RBAC administration. The ARBAC97 model comprises URA97, RPA97, and RRA97 components for user‑role, permission‑role, and role‑role assignments, and the paper also discusses potential extensions. ARBAC97 is described completely in this paper for the first time.

Abstract

In role-based access control (RBAC), permissions are associated with roles' and users are made members of roles, thereby acquiring the roles; permissions. RBAC's motivation is to simplify administration of authorizations. An appealing possibility is to use RBAC itself to manage RBAC, to further provide administrative convenience and scalability, especially in decentralizing administrative authority, responsibility, and chores. This paper describes the motivation, intuition, and formal definition of a new role-based model for RBAC administration. This model is called ARBAC97 (administrative RBAC '97) and has three components: URA97 (user-role assignment '97), RPA97 (permission-role assignment '97), and RRA97 (role-role assignment '97) dealing with different aspects of RBAC administration. URA97, PRA97, and an outline of RRA97 were defined in 1997, hence the designation given to the entire model. RRA97 was completed in 1998. ARBAC97 is described completely in this paper for the first time. We also discusses possible extensions of ARBAC97.