9 Access Control Systems for Geospatial Data and Applications
205
control mechanism determines whether the permission requested by the user belongs
to the set of permission associated to the set of enabled roles ER. If it is the case the
permission is granted otherwise it is rejected. The set of enabled roles ER in session
s and real position rp is computed by the function EnabledS essionRole(s, rp).
Definition 9.7 (Authorization Control Function). An access request is a tuple ar =
rp, p, o ∈ S ES ×RPOS ×OPS ×OBJ. ar can be satisfied at position rp ∈ RPOS
if:
(p, o) ∈
y∈EnabledS essionRoles(s,rp)
I PrmsAssignment
∗ (y).
Basic objects
FT = {Campus, Library, S ector, Address)} with: S ector ⊆ f t Campus
F = {Purdue, MyLib} with: MyLib ⊆ f Purdue
PRMS = {p 1 , p 2 , p 3 , p 4 } with
⎧
⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨
⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩
p 1 = GetMap
p 2 = S howClassT imetable
p 3 = BookLoan
p 4 = BookS earch
Schema
R = {T eacher, S tudent, LibraryS ubscriber}
R S = {S t, T e, Li} with
⎧
⎪ ⎪ ⎪ ⎨
⎪ ⎪ ⎪ ⎩
S t =< S tudent, Campus, S ector, m S ector >
T e =< T eacher, Campus, Address, m Address >
Li =< LibraryS ubscriber, Library, Library, m Library >
Instances
R I = {r S t , r T e , r Li } with
⎧
⎪ ⎪ ⎪ ⎨
⎪ ⎪ ⎪ ⎩
r S t = S tudent(Purdue)
r T e = T eacher(Purdue)
r Li = LibraryS uscriber(MyLib)
Permission assignment
S PA S = {(p 1 , S t), (p 1 , T e), (p 2 , S t), (p 2 , T e), (p 3 , Li), (p 4 , Li)}
User assignment
U = {S ara, John}
S UA = {s ua 1 , s ua 2 , s ua 3 } with
⎧
⎪ ⎪ ⎪ ⎨
⎪ ⎪ ⎪ ⎩
s ua 1 = John, S tudent(Purdue)
s ua 2 = S ara, T eacher(Purdue)
s ua 3 = John, LibraryS ubscriber(MyLib)
Sessions
S ES = {s 1 }, U serS ession(s 1 ) = {John}
S essionRoles(s 1 ) = {S tudent(Purdue), LibrayS ubscriber(MyLib)}
EnabledRoles
EnabledS essionRoles(s 1 , loc 1 ) = {{S tudent(Purdue),
LibrayS ubscriber(MyLib)}} if John is in MyLib
Fig. 9.2. An example of a GEO-RBAC policy