多维RBAC角色协同授权及其Petri网模型

基于角色的访问控制中，有效表达多角色授权、约束与激活是一个难点问题。文章从角色的语义出发．在角色集中引入维数的概念，提出一种新的多维RBAC模型，它扩展了现有的角色关系概念．使RBAC能够表达复杂的角色授权、约束与激活，另外，在此基础上提出了角色授权协同及其关系一致性分析和变换的Petri网方法．并且这种多维RBAC模型在客户关系管理系统CRM的一个基于角色的访问控制系统原型中得以实现。

Role Coordination Authorization of Multi-Dimension RBAC and It's Petri Net Model

One role may contain several concepts in RBAC model, it is a difficult problem to effectively represent the authorization and activation order constraints of multiple roles. We introduce dimensionality into role set and present a novel Multi-Dimension RBAC Model. A formal definition of Multi-Dimension RBAC model is described and an administrative model based on Multi-Dimension RBAC model is also discussed .It is able to make RBAC represent complex order constraints when granting or activating multiple roles, the new Petri Net to analyze and simulate the consistence of role authorization coordination as well as its transform relation is proposed. Multi-Dimension RBAC model is successfully deployed in a large prototype system called CRM.