Abstract
The computer network and its related information systems play a significant role in today’s companies. However, certain information security problems such as access control have emerged under the convenience brought by the information technologies.Role-based Access Control (RBAC) is an access control model along with claims that its mechanisms are general enough to simulate the traditional methods such as mandatory access control (MAC) and discretionary access control (DAC). Many research works have been conducted to investigate RBAC, but few were made in view of integration and implementation.In this study, we intend to develop a new RBAC system architecture by referring the architecture of ARBAC97 and ARBAC99. In addition, RBAC Functional Specification proposed by National Institute of Standards and Technology (NIST) will also be referred. Moreover, we replace XML (eXtensible Markup Language) with XACML (eXtensible Access Control Markup Language) as the access-control policy language. In the end of this study, we will verify our RBAC system with a real banking case.Our study is anticipated to attain the following achievements: (1) Build a RBAC system in accordance with the integration of theoretical research. (2) Construct RBAC templates based on XACML for later reference while implementing RBAC, such that the practicality of XACML can be increased.