{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T05:47:42Z","timestamp":1778305662590,"version":"3.51.4"},"reference-count":20,"publisher":"Association for Computing Machinery (ACM)","issue":"2","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst. Secur."],"published-print":{"date-parts":[[2006,5]]},"abstract":"<jats:p>Role-based access control (RBAC) is a well-accepted model for access control in an enterprise environment. When we apply RBAC model to large enterprises, effective role administration is a major issue. ARBAC97 is a well-known solution for decentralized RBAC administration. ARBAC97 authorizes administrative roles by means of role ranges and prerequisite conditions, where prerequisite conditions effectively work as a restricted pool for administrative roles to pick users or permissions. Although attractive and elegant in their own right, these mechanisms have significant shortcomings. In this paper, we propose an improved role administration model named ARBAC02 to overcome the weaknesses of ARBAC97. ARBAC02 introduces the concept of organization structure for defining user and permission pools independent of roles and role hierarchies, with a refined prerequisite condition specification. In addition, we present a bottom-up approach of permission-role administration in contrast to the top-down approach in ARBAC97. As a general solution, we illustrate the applications of organization structured-based security administration with other access control models, such as access control list model and lattice-based access control model.<\/jats:p>","DOI":"10.1145\/1151414.1151415","type":"journal-article","created":{"date-parts":[[2006,10,18]],"date-time":"2006-10-18T18:11:32Z","timestamp":1161195092000},"page":"113-137","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":54,"title":["An effective role administration model using organization structure"],"prefix":"10.1145","volume":"9","author":[{"given":"Sejong","family":"Oh","sequence":"first","affiliation":[{"name":"Dankook University, Chungnam, South Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ravi","family":"Sandhu","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xinwen","family":"Zhang","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2006,5]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Integrity Considerations for Secure Computer Systems","author":"Biba K. J.","unstructured":"Biba , K. J. 1977. Integrity Considerations for Secure Computer Systems . Mitre Corp. Report No.TR3153, Bedford, MA. (Also available through Nat'l Technical Information Service, Springfield, Va., Report No. NTIS AD--A039324.) Biba, K. J. 1977. Integrity Considerations for Secure Computer Systems. Mitre Corp. Report No.TR3153, Bedford, MA. (Also available through Nat'l Technical Information Service, Springfield, Va., Report No. NTIS AD--A039324.)"},{"key":"e_1_2_1_2_1","unstructured":"Bell D. E. and Lapadula L.J. 1975. Secure Computer Systems: Mathematical Foundations and Model. Mitre Corp. Report No. M74-244 Bedford MA. (Also available through Nat'l Technical Information Service Springfield VA Report No. NTIS AD-771543.)  Bell D. E. and Lapadula L.J. 1975. Secure Computer Systems: Mathematical Foundations and Model. Mitre Corp. Report No. M74-244 Bedford MA. (Also available through Nat'l Technical Information Service Springfield VA Report No. NTIS AD-771543.)"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/507711.507736"},{"key":"e_1_2_1_4_1","unstructured":"Ids share. Aris house. http:\/\/www.ids-scheer.com  Ids share. Aris house. http:\/\/www.ids-scheer.com"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/359205.359224"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/286884.286900"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/319171.319186"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/300830.300832"},{"key":"e_1_2_1_9_1","first-page":"921","article-title":"An improved administration method on role-based access control in the enterprise environment","volume":"17","author":"Oh S.","year":"2001","unstructured":"Oh , S. and Park , S. 2001 . An improved administration method on role-based access control in the enterprise environment . Journal of Information Science and Engineering 17 , 921 -- 944 . Oh, S. and Park, S. 2001. An improved administration method on role-based access control in the enterprise environment. Journal of Information Science and Engineering 17, 921--944.","journal-title":"Journal of Information Science and Engineering"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/344287.344299"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/354876.354878"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/373256.373292"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.241422"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of IFIP WG 11.3 Workshop on Database Security","author":"Sandhu R.","unstructured":"Sandhu , R. and Bhamidipati , V . 1997a. The URA97 model for role-based user-role assignment . In Proceedings of IFIP WG 11.3 Workshop on Database Security . Lake Tahoe, CA. Sandhu, R. and Bhamidipati, V. 1997a. The URA97 model for role-based user-role assignment. In Proceedings of IFIP WG 11.3 Workshop on Database Security. Lake Tahoe, CA."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/266741.266752"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the Annual Computer Security Applications Conference","author":"Sandhu R.","unstructured":"Sandhu , R. and Munawer , Q . 1998. The RRA97 model for role-based administration of role hierarchy . In Proceedings of the Annual Computer Security Applications Conference . Phoenix, AZ. Sandhu, R. and Munawer, Q. 1998. The RRA97 model for role-based administration of role hierarchy. In Proceedings of the Annual Computer Security Applications Conference. Phoenix, AZ."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.485845"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/1297841.1297845"},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of the Annual Computer Security Applications Conference","author":"Sandhu R.","unstructured":"Sandhu , R. and Munawer , Q . 1999. The ARBAC99 model for administration of roles . In Proceedings of the Annual Computer Security Applications Conference . Phoenix, AZ. Sandhu, R. and Munawer, Q. 1999. The ARBAC99 model for administration of roles. In Proceedings of the Annual Computer Security Applications Conference. Phoenix, AZ."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/300830.300839"}],"container-title":["ACM Transactions on Information and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1151414.1151415","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,28]],"date-time":"2022-12-28T18:36:54Z","timestamp":1672252614000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1151414.1151415"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006,5]]},"references-count":20,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2006,5]]}},"alternative-id":["10.1145\/1151414.1151415"],"URL":"https:\/\/doi.org\/10.1145\/1151414.1151415","relation":{},"ISSN":["1094-9224","1557-7406"],"issn-type":[{"value":"1094-9224","type":"print"},{"value":"1557-7406","type":"electronic"}],"subject":[],"published":{"date-parts":[[2006,5]]},"assertion":[{"value":"2006-05-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}