RBAC case studies

This section provides links to a number of RBAC case studies and experience reports, which may be useful in planning for RBAC implementations. We will add to this collection as more reports become available. (Please note that the authors and organizations below are not affiliated with NIST or any other agency of the US Government, unless otherwise noted, and NIST cannot endorse or comment on these publications.)  For comments or suggestions on this collection, contact Rick Kuhn at kuhn@nist.gov.   [updated 30 Jan 08]

Back to Top

Health Care

• A Case Study in Access Control Requirements for a Health Information System -  "a detailed examination of the access constraints for a small real-world Health Information System with the aim of achieving minimal access rights for each of the involved principals,"
• Kindred Health Care - compliance with HIPAA regulations using RBAC
• Electronic Medical Billing Software, HIPAA Compliance, and Role Based Access Control - an integrated approach to compliance for billing vendors using RBAC
• Role Based Access Control in Kidney Dialysis Information System - illustrates RBAC in medical devices
• Lighthouse International - non-profit organization for vision loss
• St. Bartholomew Hospital, London - RBAC for a medical database
• Univ. of North Carolina School of Medicine - RBAC in a medical curriculum management system
• Kentucky Health Alert Network - statewide emergency alert system  integrated with CDC, Homeland Security and other networks
• Mental Health Care Patient Management System - British regional health care authority
• Los Angeles County Health Alert System - RBAC in a messenging system serving population of 10 million

Back to Top

Government and Military Applications

• US Navy COMPACFLT Enterprise Dynamic Access Control- The EDAC accommodates complex and scalable access control situations many government and civilian organizations are experiencing when managing resource access.
• State of Nebraska E-Government - role based access in a distributed Linux-based system "to expand and improve its e-government services, while reducing taxpayer cost."
• West Yorkshire Police Case Study - RBAC "solution to automate the administration of users acrossapplications and directories and provide access, based on role and HR information."
• Brevard County Florida (Video - WMV format) - integration of biometric ID with access control; HIPAA compliance 
• Maritime Domain Awareness - RBAC for shared situational awareness among military, intelligence, and law enforcement in a maritime domain
• North Korean nuclear proliferation - using distributed RBAC to prevent enumeration of misuse cases that could identify weaknesses in coalition information sharing
• Separation of duties in the Austrian "eLaw" process - workflow and SoD for the Austrian legislature 
• e-government in Finalnd - Finnish Social Insurance institution

Back to Top

Banking and Finance

• The Role-Based Access Control System of a European Bank - "This paper describes the access control system of a major European Bank. An overview of the system’s structure, its administration and existing control principles constraining the administration is given."
• Separation of Duty  in a financial institution using RBAC
• Identity management for a global bank - integrating ID management and RBAC
• Mutual Life insurance company - synchronizing identity information across organizations
• General insurance company in India    
• Multiline insurance company (see chap. 6 of this Research Triangle Institute study for NIST)
• Banking, insurance, and other firms using commercial RBAC software.

Back to Top

IT Infrastructure

• How role-based access control can provide security and business benefits - overview of cost benefit aspects of role based access control.
• Role-Based Access Control Using Windows Server 2003 Authorization Manager  - "How to create, maintain and manage a role-based application using Authorization Manager and its associated MMC snap-in, AzMan."
• A Role-Based Access Control (RBAC) system for PHP
• Implementing Role Based Access Controls Using X.509 Attribute Certificates - "describes a policy driven role based access control system. The user's roles, and the policy are stored in X509 Attribute Certificates. The policy, written in XML, describes who is trusted to allocate roles to users, and what permissions each role has."
• Implementation of Active Role Based Access Control in a Collaborative Environment  - "to investigate current RBAC models and the possible methods that can be applied to transform “passive” models into “active” models such that they can fulfil the current security requirements of collaborative environments."
• The CVS Server Case Study - RBAC for the Concurrent Versioning System
• Observations on the Real World Implementation of Role Based Access Control - reports on several commercial implementations of RBAC
• Increasing Performance and Granularity in Role Based Access Control Systems - using RBAC in Linux systems
• Marathon Oil  case study - Sarbanes Oxley compliance, risk management, and separation of duties

Back to Top