Role-Based Access Controls

Published

October 13, 1992

Author(s)

David F. Ferraiolo, David R. Kuhn

Abstract

While Mandatory Access Controls (MAC) are appropriate for multilevel secure military applications, Discretionary Access Controls (DAC) are often perceived as meeting the security processing needs of industry and civilian government. This paper argues that reliance on DAC as the principal method of access control is unfounded and inappropriate for many commercial and civilian government organizations. The paper describes a type of non-discretionary access control: role-based access control (RBAC) that is more central to the secure processing needs of non-military systems than DAC.

Proceedings Title

15th National Computer Security Conference

Conference Dates

October 13-16, 1992

Conference Location

Baltimore, MD

Pub Type

Conferences

Download Paper

Local Download

Keywords

access control, computer security, discretionary access control, integrity, mandatory access control, role, RBAC, role based access control, TCSEC

Citation

Ferraiolo, D. and Kuhn, D. (1992), Role-Based Access Controls, 15th National Computer Security Conference, Baltimore, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=916401 (Accessed May 28, 2025)