Double-Tier Role and Organization-Based Cross-Domain Access Control Mechanism

Abstract

Aiming at the deficiencies of weak adaptability due to the singleness of the role establishment method, relatively high management complexity and the security problems such as covert role promotion and privilege penetration in the existing methods, a double-tier role and organization-based cross-domain access control mechanism is proposed. The double-tier role architecture of function role and task role resolves the problem that traditional concept of role couldn't cover the requirements of both organizational level and application level at the same time and meets the practical needs of role establishment with strong adaptability. A scalable double-tier role and organization-based access control model (DTR-OBAC) is put forward and defined formally based on the double-tier role architecture and organization. The concept of virtual sharing organization is introduced and treated as the common subordinate organization of participating domains. The cross-domain access control mechanism is present based on DTR-OBAC model and virtualsharing organization, to achieve security interoperation. The practicability and feasibility is verified with an example and the features are analyzed, indicating that the mechanism meets the principles of autonomy and security in interoperation.