Design and Implementation of a Role-Based Access Control System
Design and Implementation of a Role-Based Access Control System
Abstract
Role-Based Access Control (RBAC) is the dominant model for managing authorization in enterprise information systems. By assigning permissions to roles rather than individual users, RBAC reduces administrative overhead and aligns access control with organizational structure. However, many implementations lack standardization, hierarchical flexibility, and robust database schemas, leading to inconsistent behavior and security gaps. This project presents the design and implementation of an RBAC system based on the NIST/INCITS 359 standard. The system implements core RBAC components—users, roles, permissions, and sessions—along with role hierarchies and assignment constraints. A normalized MySQL database schema provides the foundation for user-role and role-permission assignments, with efficient permission-check queries using indexed joins. Administrative interfaces enable role creation, permission assignment, and user provisioning. The implementation demonstrates how to enforce least privilege through role design and provides extensibility points for integration with external identity providers. The system serves as a foundational authorization layer for web applications requiring structured access control.
Keywords: Role-Based Access Control; RBAC; NIST RBAC; Access Control; Database Schema; Authorization
________________________________________
Chapter 1: Introduction
1.1 Background
Access control is a fundamental security mechanism that determines which users can perform which operations on which resources. As organizations grow, managing access permissions individually becomes impractical and error-prone. Role-Based Access Control (RBAC) addresses this challenge by introducing roles as an abstraction layer between users and permissions.
The RBAC model was formalized in 1992 by David Ferraiolo and Rick Kuhn at the National Institute of Standards and Technology (NIST). The model gained rapid adoption because it mirrors how organizations actually operate: employees have job functions (roles), and job functions require specific capabilities (permissions). When an employee changes positions, only their role assignment changes—not their individual permissions.
In 2004, the American National Standards Institute (ANSI) published the INCITS 359 standard, providing a unified definition of RBAC that resolved inconsistencies across earlier models and commercial implementations. This standard remains the authoritative reference for RBAC system design.
1.2 Problem Statement
Despite RBAC's conceptual simplicity, implementation presents several challenges:
Standardization Gaps: Many systems implement custom RBAC variants that deviate from established standards, creating interoperability issues and security inconsistencies.
Database Design Complexity: RBAC requires carefully normalized schemas to support efficient permission checks while maintaining data integrity across user-role and role-permission relationships.
Hierarchical Role Management: Organizations often require role hierarchies where senior roles inherit permissions from junior roles, but implementing inheritance without creating privilege concentration requires careful design.
Integration Requirements: Modern applications need RBAC to integrate with external identity providers and support multiple deployment patterns.
1.3 Objectives
This project aims to design and implement a standards-compliant RBAC system that:
1. Implements the NIST/INCITS 359 RBAC reference model including core, hierarchical, and constrained components.
2. Provides a normalized MySQL database schema for users, roles, permissions, and their associations.
3. Implements efficient permission-check queries using indexed joins and role hierarchy traversal.
4. Delivers administrative interfaces for role and permission management.
5. Supports integration with external identity providers through token-based role claims.
1.4 Scope and Limitations
The system focuses on application-level RBAC for web-based systems. It does not implement operating system or database-level access controls. The current implementation uses MySQL as the persistence layer; other databases would require schema adaptation. Integration with identity providers is demonstrated through token-based role claims but not fully implemented for all providers.
1.5 Thesis Structure
Chapter 2 reviews the NIST RBAC standard and related implementation approaches. Chapter 3 presents the system architecture and database design. Chapter 4 describes the implementation of core components. Chapter 5 concludes with limitations and future work.
________________________________________
Chapter 2: Literature Review
2.1 The NIST RBAC Standard
The NIST RBAC standard defines a reference model and a system/administrative functional specification. The reference model specifies four model components:
Core RBAC: Defines the minimum set of RBAC elements and relationships required for any RBAC system. This includes user-role assignment and permission-role assignment, along with the concept of sessions as temporary associations between users and roles.
Hierarchical RBAC: Adds role hierarchies to the core model, allowing roles to inherit permissions from other roles. The standard distinguishes between general hierarchical RBAC and limited hierarchical RBAC.
Static Separation of Duty (SSD) Relations: Defines constraints that prevent users from being assigned conflicting roles simultaneously.
Dynamic Separation of Duty (DSD) Relations: Defines constraints that prevent conflicting roles from being activated in the same session.
The system and administrative functional specification defines three categories of functionality:
• Administrative Operations: Functions to create, delete, and maintain RBAC elements and relationships (e.g., creating user-role assignments).
• Administrative Reviews: Functions to query RBAC elements and relationships.
• System-Level Functions: Functions for session creation, role activation/deactivation, constraint enforcement, and access decision computation.
2.2 Core RBAC Elements
The standard defines the fundamental RBAC elements:
Users: Individuals or automated agents that interact with the system.
Roles: Job functions or responsibility sets within an organization, with associated semantics regarding authority and responsibility.
Permissions: Approvals to perform operations on objects, typically expressed as resource-action pairs.
Operations: Executable images of programs that perform functions for users.
Objects: System resources that contain or receive information.
Sessions: Mappings between users and roles that define the roles activated during a particular interaction.
2.3 Database Schema Patterns
Practical RBAC implementations require normalized database schemas. A widely adopted pattern defines five core tables:
users: User identity and authentication information, with a unique constraint on email.
roles: Role definitions with name and description, with a unique constraint on role name.
permissions: Resource-action pairs with a unique constraint on (resource, action).
role_permissions: Many-to-many association between roles and permissions, with foreign keys cascading on delete.
user_roles: Many-to-many association between users and roles, including grant metadata (granted_at, granted_by).