主动授权规则实施支持空间特性的RBAC*

为满足安全策略或者角色定义的变化，系统或模型应该提供一种灵活的机制实施支持空间特性的RBAC。引入了OITE（on-if-then-else）主动授权规则实施支持空间特性的RBAC，定义了支持空间特性的RBAC中各基本元素与OITE之间的映射关系。使用OITE作为实施机制，可以在不同粒度上实施带有空间特性角色约束，并且可以将支持空间特性的RBAC应用在多个领域中。最后简要讨论了授权规则如何从支持空间特性的RBAC安全策略中自动产生。

Active authorization rules for enforcing RBAC with spatial characteristics

To meet security policy or role structure changes, systems or models should provide a flexible mechanism for enforcing role-based access control (RBAC) with spatial characteristics in a seamless way. This paper used on-when-then-else authorization rules for enforcing RBAC with spatial characteristics. And showed the mapping between the basic elements in RBAC with spatial characteristics and the OWTE rule specification. Established OWTE rules as an enforcement mechanism, which could realize role-based constraints with spatial characteristics at different granularities and make RBAC with spatial characteristics usable in diverse domains. Finally discussed briefly how these authorization rules could be automatically generated from security policies using RBAC with spatial characteristics.