Role-Based Access Control on the Web

Joon S. Park, Ravi Sandhu, Gail Joon Ahn

Research output: Contribution to journalArticle

156 Scopus citations

Abstract

Current approaches to access control on Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current Web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.

Original languageEnglish (US)
Pages (from-to)37-71
Number of pages35
JournalACM Transactions on Information and System Security
Volume4
Issue number1
DOIs
StatePublished - 2001

Keywords

  • Cookies
  • Design
  • Digital certificates
  • Experimentation
  • Role-Based access control
  • Security
  • WWW security

ASJC Scopus subject areas

  • Computer Science(all)
  • Safety, Risk, Reliability and Quality

Fingerprint Dive into the research topics of 'Role-Based Access Control on the Web'. Together they form a unique fingerprint.

  • Cite this