RACAC: An Approach toward RBAC and ABAC Combining Access Control

Either RBAC or ABAC has its own advance and shortage in large enterprise applications, thus there is a need for a hybrid access control model which combines the merits of both models. By weighing the advantages and disadvantages of both models, this paper proposes an easy way to implement a general framework of hybrid access control which combines the merits of RBAC and ABAC. The model support dynamic authentication and authorization by using attribute policies which is based on the RBAC infrastructure framework. We give a case study to implementation and analyze the hybrid model RACAC. The experiments show that RACAC model overcomes many limitations of pure RBAC and ABAC, effectively lessens the complexity and enhances the flexibility of privilege management in fine-grained access control system compared to a pure RBAC or ABAC model.