分级联合租户的访问控制
Access Control for Hierarchical Joint-Tenancy
摘要：
基本的基于角色的访问控制[RBAC]提供了一种基于组织内用户的分层角色来隔离访问权限的机制。当存在多个层次结构的紧密集成时，此模型不能很好地扩展。在存在联合租用和基于用户的层次结构的不同披露级别的需求的情况下，或者在我们的情况下，组织或公司，基本RBAC要求这些层次结构被有效地合并。必须转换有效代表用户组织和角色的特定角色，以适应用于控制访问的合并层次结构。从本质上讲，来自多个组织的用户从一个角色库中获得服务，这些角色旨在根据需要限制他们的访问。我们的工作建议，通过参数化的角色和特权，一种手段，准确地表示用户的角色在各自的层次结构中提供访问控制对象。使用此方法将减少角色和权限数量方面所需的复杂性。由此产生的角色、特权和对象集将大大简化访问角色层次结构的建模和可视化。本文将给出一些基于角色的访问控制，参数化的角色和特权的背景，然后专注于如何与参数化的角色和特权的RBAC可以作为一个访问控制解决方案的联合租赁所提出的问题。
英文摘要：
Basic role based access control [RBAC] provides a mechanism for segregating access privileges based upon a user's hierarchical roles within an organization. This model doesn't scale well when there is tight integration of multiple hierarchies. In a case where there is joint-tenancy and a requirement for different levels of disclosure based upon a user's hierarchy, or in our case, organization or company, basic RBAC requires these hierarchies to be effectively merged. Specific roles that effectively represent both the user's organizations and roles must be translated to fit within the merged hierarchy to be used to control access. Essentially, users from multiple organizations are served from a single role base with roles designed to constrain their access as needed. Our work proposes, through parameterized roles and privileges, a means for accurately representing both users' roles within their respective hierarchies for providing access to controlled objects. Using this method will reduce the amount of complexity required in terms of the number of roles and privileges. The resulting set of roles, privileges, and objects will make modeling and visualizing the access role hierarchy significantly simplified. This paper will give some background on role based access control, parameterized roles and privileges, and then focus on how RBAC with parameterized roles and privileges can be leveraged as an access control solution for the problems presented by joint tenancy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
