An effective role administration model using organization structure

TLDR

Role‑based access control (RBAC) is widely used in enterprises, but effective role administration in large organizations remains a challenge, and existing solutions such as ARBAC97 suffer from significant limitations. This paper proposes ARBAC02, an improved role administration model that addresses the weaknesses of ARBAC97. We introduce ARBAC02, which uses an organization‑structured hierarchy to define user and permission pools independently of roles, refines prerequisite conditions, adopts a bottom‑up permission‑role administration approach, and demonstrates applicability to ACL and lattice‑based models.

Abstract

Role-based access control (RBAC) is a well-accepted model for access control in an enterprise environment. When we apply RBAC model to large enterprises, effective role administration is a major issue. ARBAC97 is a well-known solution for decentralized RBAC administration. ARBAC97 authorizes administrative roles by means of role ranges and prerequisite conditions, where prerequisite conditions effectively work as a restricted pool for administrative roles to pick users or permissions. Although attractive and elegant in their own right, these mechanisms have significant shortcomings. In this paper, we propose an improved role administration model named ARBAC02 to overcome the weaknesses of ARBAC97. ARBAC02 introduces the concept of organization structure for defining user and permission pools independent of roles and role hierarchies, with a refined prerequisite condition specification. In addition, we present a bottom-up approach of permission-role administration in contrast to the top-down approach in ARBAC97. As a general solution, we illustrate the applications of organization structured-based security administration with other access control models, such as access control list model and lattice-based access control model.