Concept - Role-Based Access Control
RBAC: access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles (s.6). “Increasingly popular” (s.6).
- Traditional DAC defines rights of individual users and groups; RBAC is based on the roles users assume rather than identity (s.21).
- Rights are assigned to roles, not individual users; users are assigned to roles by responsibilities; the user-to-role relationship is many to many (s.21).
- Figures: users roles resources (s.20); a user-role matrix and a role-object matrix (s.22).
- The four reference models RBAC0-RBAC3 are in Concept - RBAC Reference Models.
Example: reading the tree on s.26, a project lead role sits above the production and quality engineer roles, so it implicitly includes their access rights (Concept - Role Hierarchy).
Added context
Your class notes list a fourth model “Rule-based access control (RBAC, optional)”; the slides only define role-based. Do not mix them up.
Related: Concept - RBAC Constraints, Concept - Discretionary Access Control, Concept - Mandatory Access Control. Appears in 04 Access Control - Chunk 01 (s.1-28).