RoleVAT: Visual Assessment of Practical Need for Role Based Access Control

Role-based access control (RBAC) is the most predominant access control model in today's security management due to its ability to simplify authorization, and flexibility to specify and enforce protection policies. In RBAC, Separation of Duty (SoD) constrains user role authorization to protect sensitive information from frauds due to conflicts of interests. SoD constraints are commonly defined by mutually exclusive roles (MER) (e.g., bank teller and auditor). This paper proposes practical computational techniques for analyzing SoD by integrating workflows of the enterprise processes into the RBAC framework. Specifically, we present 1) an algorithm for generating MER to enforce SoD, and 2) a verification algorithm to check if a given RBAC state (role authorization and user-role assignments) satisfies a given type of SoD constraint or not. The paper discusses the details of the approach and illustrates its use in a loan application domain.

Information security and access control is an important part of CSCD applying. RBAC (role based access control) as an access control technology using for distributed system has been widely researched these years. Role hierarchies is one component of RBAC model, it can reduce the workload of permission assignment. Nowadays most research of RBAC has no relation with timing constraint. The main purpose of this article is to study the effect of temporal constraint acting on role hierarchy. The basis of the study is RBAC96 model, first we analyse the change of role state, propose 3 forms of temporal constraint and give the expression of temporal constraint. Then we present an analysis of the effects of temporal constraint on role enabling and role activation which has various implication on a role hierarchy, and at last we formally describe a timing restricted role hierarchies model

Since Role-Based Access Control (RBAC) shows great advantage in meeting the security need in large-scale and enterprise-wide system, RBAC becomes the hot topic in access control research field. However, current approaches to access control are mostly based on individual user identity; hence they do not scale to distributed systems. So, the paper analyses RBAC could not satisfy dynamic access control in distributed environment, and puts forward an dynamic access control model based on roles and trust control, giving every trust value for each user by introducing trust management to access control, each role corresponds a certain trust vale, users and systems give values for each other after operation, trust management modesties and updates trust values, users roles will change accordingly, The experiment shows that the model is much validated, and something useful is obtained. The extended model can meet the need to manage and enforce the strong and efficient access control technology in large-scale environments. The flexility and broad application of the proposed model through the system is testified and something useful is obtained.

Access control policies of XML documents are often specified based on user roles and data content of the documents. Content-based authorization is crucial for providing fine-grained access control to data in XML document. Since authorization rules (authorizations, for short) use path expressions of XPath for locating data in documents, authorization definition is related to structure of the document. However, the structure of XML documents tends to change by various reasons such as application extension and information exchange between organizations. Therefore, authorizations must be revised whenever they become incompatible with a new structure of the document. As far as we know, no previous work has discussed the problem of transforming content-based authorizations for XML documents by using schema mapping information. We define classes for schema and document transformations that allow transforming authorizations without access to source and target XML documents. We propose an algorithm that computes authorizations of role-based access control (RBAC) model for a target DTD instance from given RBAC authorizations of a source DTD instance and schema mapping information under the specified classes of schema and document transformations while preserving the authorization policy of the source DTD instance.

In today's dynamic networking environment, securing access to resources has become increasingly challenging due to the growth and progress of connected devices. This study explores the integration of Role-Based Access Control (RBAC) and OAuth 2.0 protocols to enhance network access management and security enforcement in an Android mobile application. The study adopts a waterfall methodology to implement access control mechanisms that govern authentication and authorization. OAuth 2.0, a widely adopted open-standard authorization framework, was implemented to secure user authentication by allowing third-party access without exposing user credentials. Meanwhile, RBAC was leveraged to streamline access permissions based on predefined user roles, ensuring that access privileges are granted according to hierarchical role structures. The main outcomes of this study show significance towards the improvements in security enforcement and user access management. Specifically, the implementation of multi-factor authentication, session timeout mechanisms, and user role-based authorization ensured robust protection of sensitive data while maintaining system usability. RBAC proved effective in controlling access to various system resources, such as database operations which was presented in scenario of physical access to doors, while OAuth 2.0 provided a secure communication channel for authentication events. These protocols, working in tandem, addressed key issues like unauthorized access, data integrity, and scalability in network security policy enforcement. This research deduces that combining RBAC and OAuth 2.0 protocols in mobile applications enhances security posture, simplifies access management, and mitigates evolving threats.

During the past decade, there has been an explosion in the complexity of software applications, with an increasing emphasis on software design via model-driven architectures, patterns, and models such as the unified modeling language (UML). Despite this, the integration of security concerns throughout the product life cycle has lagged, resulting in software infrastructures that are untrustworthy in terms of their ability to authenticate users and to limit them to their authorized application privileges. To address this issue, we present an approach to integrate role-based access control (RBAC) into UML at design-time for permission assignment and enforcement. Specifically, we introduce a new UML artifact, the role slice, supported via a new UML role-slice diagram, to capture RBAC privileges at design time within UML. Once captured, we demonstrate the utilization of aspect-oriented programming (AOP) techniques for the automatic generation of security enforcement code. Overall, we believe that our approach is an important step to upgrading security to be an indispensable part of the software process.

Access control is generally a rule or procedure that allows, denies, restricts or limit access to system's resources. It may, as well, monitor and record all attempts made to access a system. Access Control may also identify users attempting to access unauthorized resources. It is a mechanism which is very much important for protection in computer security. Various access control models are in use, including the most common Mandatory Access Control (MAC), Discretionary Access Control (DAC) and Role Based Access Control (RBAC). All these models are known as identity based access control models. In all these access control models, user (subjects) and resources (objects) are identified by unique names. Identification may be done directly or through roles assigned to the subjects. These access control methods are effective in unchangeable distributed system, where there are only a set of Users with a known set of services. For this reason, we propose a framework which is well suited to many situations in cloud computing where users or applications can be clearly separated according to their job functions. In this chapter, we proposes a role based access control framework with various features including security of sensitive data, authorization policy and secure data from hackers. Our proposed role based access control algorithm provides tailored and fine level of user access control services without adding complexity, and supports access privileges updates dynamically when a user's role is added or updated.

Operations in the aviation domain routinely require coordination and dynamic information exchange with multiple organizations. These organizations may be government, commercial, or private. In today's heightened information security environment, communication between disparate organizations is often facilitated through the use of credentialing mechanisms and technologies. This short paper discusses some of the prototyping and demonstration efforts that have been performed to investigate and inform credentialing in the aviation domain.

- — Administrative workflows in educational institutions continue to rely heavily on paper-based procedures, causing significant delays, inconsistencies, and resource wastage. This paper introduces EduForms, an intelligent, web-based institutional forms management platform built on the MERN stack — MongoDB, Express.js, React.js, and Node.js. The platform eliminates manual intervention through a combination of automated multi-level approval chains, role-based access control across eight distinct user roles, and intelligent AI-assisted form discovery. A Two-Factor Authentication mechanism utilizing One-Time Passwords enhances login security. An embedded AI assistant called EduBot allows users to locate appropriate forms through natural language interaction, while a universal voice-based form-fill module enables field population through spoken input — supporting all form types and fields. A smart approval automation engine evaluates submissions against predefined rules and automatically approves routine requests, while a priority-based routing mechanism escalates urgent applications directly to higher authorities. A predictive analytics widget presents approval probability estimates derived from historical submission data. The system supports forty-nine form templates spanning eight role-specific portals and includes a contextual feedback mechanism and a comprehensive exam branch management portal. Experimental evaluation confirms measurable reductions in processing time, improved submission accuracy, and a substantially enhanced user experience compared to conventional manual systems. Keywords: MERN Stack, Intelligent Form Management, Two-Factor Authentication, AI-Assisted Workflow, Voice Form Fill, Priority-Based Routing, Smart Approval Automation, Real-Time Tracking, Role-Based Access Control

Many engineering colleges still use manual methods like paper registers and notice boards for managing attendance and results. This makes things slow and students often do not get information on time. In this paper we present a web- based Student Portal built during our Second Year Engineering project. The system supports four types of users - Student, Faculty, Admin, and Parent - each with their own login and dashboard. We used React.js for the frontend, Node.js and Express.js for the backend, and MongoDB Atlas to store data. Login is secured using JSON Web Tokens (JWT). Access to each dashboard is controlled based on the user role, both on the frontend and the backend. Role separation was confirmed - no user could access another role's data. The system is a simple but working solution to replace paper- based academic management

The Institution Placement Data Management System is a comprehensive, web-based application designed to streamline and automate the entire campus recruitment process in academic institutions. The system acts as a centralized platform facilitating seamless interaction between students, placement officers, and recruiters. It empowers students to register, maintain detailed profiles, track eligibility, and apply for placement drives, while providing admins with robust tools to post job opportunities, manage student applications, filter candidates based on criteria, and schedule interviews or aptitude tests. The platform ensures secure and differentiated access using Role-Based Access Control (RBAC), enabling precise control over functionalities based on user roles such as student, admin, and recruiter. Students receive real-time notifications and alerts regarding new job postings, application status, and interview schedules, thus enhancing transparency and engagement. Developed using the MERN stack (MongoDB, Express.js, React.js, Node.js) with MySQL as the primary data storage solution for handling relational data, the system leverages modern web technologies to ensure a responsive, intuitive, and scalable user experience. The system incorporates data validation, search and filter functionalities, profile edit history, and analytics dashboards for placement statistics and drive performance. By automating manual processes and offering structured data management, the system significantly reduces administrative overhead, eliminates redundancies, and ensures efficient placement coordination.

Most of valuable information resources for all organizations are stored in database. It's a serious subject to protect this information against intruders. However, conventional security mechanisms haven't been designed to detect anomalous actions of database users. Intrusion detection systems (IDS) deliver an extra layer of security that cannot be guaranteed by built-in security tools. IDS provide the ideal solution to defend databases from intruders. In this paper, we suggest an anomaly detection approach that summarizes the raw transactional SQL queries into compact data structure called hexplet, which can model normal database access behavior (abstract the user's role profile) and recognize impostors specifically tailored for role-based access control (RBAC) database system. This hexplet allows us to preserve the correlation among SQL statements in the same transaction by exploiting the information in the transaction-log entry. Our target is to improve detection accuracy, specially the detection of those intruders inside the organization who behave strange behavior. Our model utilizes Naive Bayes Classifier (NBC) as a simple technique for evaluating the legitimacy of transaction. Experimental results show the performance of the proposed model in the term of error equal rate.

In order to solve the access control problems of network management system in development, This paper presents a role-based multi-granularity access control program, this program implements logical separation between user and access rights, you can customize roles for different user according to their needs, making network management system more flexible and secure in the user management; the program has put fine-grained control of the roles into practice and solve the problem of regional resources access control.

Cloud computing is a widespread technology, which has attracted much attention nowadays. Among the many criteria that must be considered for data storage in the cloud, access control plays a vital role. Role-based access control (RBAC) is a well-known technique for secure data storage in the cloud. Since the traditional RBAC models are improper for open and decentralized environments, recently, some works have integrated the trust concept into the RBAC model. Nevertheless, they have not fully addressed the required security metrics of a trust-based system. Therefore, in this paper, we first introduce the security goals that should be considered in an efficient trust-based system. Second, we propose a novel trust and reputation based RBAC model that not only can properly withstand the security threats of trust-based RBAC models, but also is scalable as it has reasonable execution time. Third, we evaluate the proposed model using the famous trust network of advogato dataset. Eventually, we compare the proposed model with recently-published ones in terms of mean absolute error, execution time of indirect trust computation, and provided features. The achieved results are indicative of the priority of the proposed model to be employed in real cloud environments.

Roles are a powerful concept for facilitating distributed systems management. It has been accepted as a good solution for information sharing based on the research of KB AC (role-based access control). Although no explicit roles are declared in traditional CSCW (computer-supported-cooperative work) systems, there are implicit roles granted in the design. Consequently, we may infer that "without roles, there would be no collaboration". There is, however, a lack of specific, comprehensive research on building collaborative systems with role management and on role-based methods that have been successfully used in access control. This paper aims to clarify the basic problems related to the research of role-based collaboration and to propose a basic method to do that research.