On Conceptual Modelling and Design of Role-Based Access Control Systems

In this talk, we present a formal approach for role-based access control systems design and emphasize the role of conceptual modelling of various relationships and constraints in RBAC systems. Users access control is a critical and sensitive issue in many systems and applications, especially for many web-based systems with large number of users, proper access control is a key issue for system security. Role-based access control governs users’ access to the information on the basis of users’ positions in the organisation (outside the organisation as well). RBAC involves individual users being associated with roles as well as roles being associated with permissions (Each permission is a pair of object set and operation set). As such, a role is used to associate users and permissions. A user in this model is a human being. A role is a job function or job title within the organization associated with authority and responsibility.