# Role-Based Access Control Model for Inter-System Cross-Domain in Multi-Domain Environment
###### Abstract  
Information service platforms or management information systems of various institutions or sectors of enterprises are gradually interconnected to form a multi-domain environment. A multi-domain environment is convenient for managers to supervise and manage systems, and for users to access data across domains and systems. However, given the complex multi-domain environment and many users, the traditional or enhanced role-based access control (RBAC) model still faces some challenges. It is necessary to address issues such as role naming conflicts, platform-domain management conflicts, inter-domain management conflicts, and cross-domain sharing difficulties. For the above problems, a role-based access control model for inter-system cross-domain in multi-domain environment (RBAC-IC) is proposed. This paper formally defines the model, divides roles into abstract roles and specific roles, and designs the operating process of the access control model. The model has four characteristics: support role name repetition, platform-domain isolation management, inter-domain isolation management, and fine-grained cross-domain sharing. By establishing security violation formulas for security analysis, it is finally shown that RBAC-IC can operate safely. role-based access control (RBAC); inter-system cross-domain; access control; multi-domain environment; information service platform +
Footnote †: journal: Applied Sciences  
In such a multi-domain environment, it is conducive to data sharing among enterprise sectors or various institutions within the organization, and it is also beneficial for managers to supervise and manage the systems. Access control can prohibit illegal users from accessing resources in the system and prevent unauthorized operations by legitimate users in the system. There are many access control technologies, among which role-based access control (RBAC) [8] introduces the concept of role between users and permissions. It assigns permissions to roles based on business responsibilities, and then grants roles to users. The introduction of \"role\" simplifies the management of access control in complex systems, and RBAC has been widely used [9; 10; 11; 12]. However, multi-domain environment is necessary to ensure data isolation among systems and to satisfy cross-domain sharing of data by users. Under these premises, how to improve RBAC and design an access control model for inter-system cross-domain, to control of user access is an urgent problem to be solved. At present, there is a lot of research on the cross-domain access control model. However, there are still the following problems to be solved in the current research results:  
* Role naming conflict: After the introduction of the role concept [8], although the same roles have similar responsibilities in different domains, it is necessary to allow the same roles to have different permissions in different domains. * Platform-domain management conflict: Avoid domain administrators from unauthorized manipulation of the platform, and platform administrators from accessing domain server business data, resulting in privacy leakage. * Inter-domain management conflicts: In a multi-domain environment, different domains need to be isolated for management, and data among systems also need to be isolated. * Fine-grained cross-domain sharing: Meet users' needs for inter-system cross-domain access control. When a role is authorized cross-domain, only the required users are authorized, and the role authorization rights are not assigned to other domain administrators. Aiming at the above problems, a role-based inter-system cross-control model (RBAC-IC) is designed. Based on the traditional RBAC model, roles are extended to abstract roles and specific roles. Abstract roles define the scope of responsibility, set hierarchies and constraints of roles; specific roles are responsible for assigning permissions and authorizing users. Platform personnel are divided into three categories: platform administrators, domain administrators and ordinary users.