A Role-Based Access Control Model for Complex Affairs

Due to the complexity in the management of users, operations, and resources of services, and the dynamic changing nature of application environments, traditional role-based access control (RBAC) struggle to satisfy the need of applications. The RBAC model does not treat complex affairs as integral units and decompose complex affairs into sub-affairs without maintaining the relation of sub-affairs. This paper proposes a role-based access control model for complex affairs (CARBAC) to tackle this issue. In the proposed model, the notion of authorization dependence (AD) is introduced to describe the relation of authorization between different affairs and directed graph is adopted to describe the structure of complex affairs. CARBAC model supports dynamic separation of duty (DSD) and maintains the integrality of complex affair. Three algorithms are given to deal with complex affair access control using CARBAC model.