Design and Performance Evaluation of a Role-Based Access Control Model for Secure Web Applications

Role-Based Access Control (RBAC) is an effective method for managing users’ access to resources. The present research aims to design an RBAC model that will assign users specific roles and utilize server-side checking to ensure the proper use of permissions. The study will demonstrate how the authorization tool can help eliminate unauthorized access and enhance management functions in terms of permissions and roles. In addition, the research will also assess the security and performance aspects of the model to evaluate its effectiveness and identify potential vulnerabilities. By doing this study, one will understand how the application can be fortified against illegal intrusions and what weaknesses should be taken into consideration when developing software. Future studies may build on the findings of this research by elaborating on the best practices for creating resilient web applications. One of the potential directions of the investigation is the creation of a standard RBAC model that will also include other security measures, such as multifactor authentication, attribute-based access control, and intrusion detection mechanisms.

1.                The NIST Model for Role-Based Access Control: Towards a Unified Standard. Proceedings of the Fifth ACM Workshop on Role-Based Access Control, 47–63. https://doi.org/10.1145/344287.344301 2.                Barkley, J., Kuhn, D. R., Rosenthal, L. S., Skall, M., & Cincotta, A. V. (1998). Role-Based Access Control for the Web. CALS Expo International and 21st Century Commerce 1998: Global Business Solutions for the New Millennium. National Institute of Standards and Technology. https://www.nist.gov/publications/role-based-access-control-web 3.                Ferraiolo, D. F., Barkley, J., & Kuhn, D. R. (1999). A Role-Based Access Control Model and Reference Implementation Within a Corporate Intranet. ACM Transactions on Information and System Security, 2(1), 34–64. https://doi.org/10.1145/300830.300834 4.                Barkley, J., Cincotta, A. V., Ferraiolo, D. F., Gavrila, S. I., & Kuhn, D. R. (1997). Role Based Access Control for the World Wide Web. Proceedings of the 20th National Information Systems Security Conference, 331–340. National Institute of Standards and Technology. 5.                Gavrila, S. I., & Barkley, J. (1998). Formal Specification for Role Based Access Control User/Role and Role/Role Relationship Management. Proceedings of the Third ACM Workshop on Role-Based Access Control, 81–90. https://doi.org/10.1145/286884.286902 6.                Jansen, W. (1998). A Revised Model for Role-Based Access Control (NIST Interagency Report 6192). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.6192 7.                OWASP Foundation. (n.d.). Authorization Cheat Sheet. OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html 8.                OWASP Foundation. (2021). A01:2021 – Broken Access Control. OWASP Top 10. https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/