ROLE-BASED ACCESS CONTROL

ROLE-BASED ACCESS CONTROL (RBAC) IS AN IDEAN WHOSE TIME HAS COME. DAC AND MAC, AS SPECIFIED IN DOD'S LANDMARK ORANGE BOOK, ARE INADEQUATE FOR MANY COMMERCIAL AND CIVILIAN GOVERNMENT ORGANIZATIONS. DAC IS TOO WEAK AND MAC IS FOCUSSED ON CONFIDENTIALITY OF CLASSIFIED INFORMATION. RBAC HAS THEREFORE EMERGED AS A THIRD FORM OF ACCESS CONTROL TO FILL THIS URGENT NEED. ALTHOUGH THERE IS A GROWING CONSENSUS THAT RBAC IS A GOOD APPROACH, THERE REMAINS A LACK OF UNDERSTANDING AND CONSENSUS ABOUT EXACTLY WHAT RBAC MEANS. THE CENTRAL TECHNICAL GOAL OF THIS RESEARCH IS TO CHARACTERIZE RBAC BY UNIFYING VARIOUS FLAVORS OF RBAC THAT HAVE BEEN PUBLISHED OR DEPLOYED IN COMMERCIAL PRODUCTS. ACCORDINGLY, THIS RESEARCH WILL (1) DEVELOP A CONCEPTUAL FRAMEWORK AND THEORETICAL MODEL FOR RBAC, (2) PROVIDE A SPECIFICATION FOR IMPLEMENTING THIS MODEL, (3) BUILD AN EXPERIMENTAL IMPLEMENTATION OT ILLUSTRATE APPLICATION OF THE MODEL, (4) INVESTIGATE APPROACHES FOR IMPLEMENTING RBAC IN CONTEXT OF EXISTING AND EMERGING COMMERCIAL PRODUCTS, AND (5) IDENTIFY TOOLS FOR SUPPORTING THE ADMINISTRATION AND OPERATION OF RBAC. THIS RESEARCH WILL PROVIDE A COMMON FRAMEWORK FOR EXPERIMENTAL IMPLEMENTATION OF PROTECTION MECHANISMS TO ENFORCE RBAC, AND THEIR MIGRATION INTO COMMERCIAL PRODUCTS, IN PHASES 2 AND 3 OF THIS PROJECT.