# Role-Based Access Control Model for Inter-System Cross-Domain in Multi-Domain Environment
## 4 Dynamic mutex constraint;
#### 6.2.3 Model Cross-Domain Security Analysis  
For cross-domain authorization and cross-domain access in the model, security interoperability needs to be met. For authorization, the domain administrator cannot authorize the specific role of other domains to users. For access, users cannot hold the specific role or permission of other domains to access the objects of the requesting domain. 1. Cross-domain authorization; (_da[category] = domain_administer_\(\wedge\)_da[domain] = domain_\({}_{1}\)\(\wedge\)_sr[domain] = domain_\({}_{2}\))\(\wedge\)_authorization_(_da_, \(u\), _sr_) where _authorization_(_da_, \(u\), _sr_) means that the domain administrator _da_ authorizes the specific role _sr_ for user \(u\). This formula describes that _da_ is the domain administrator of _domain_\({}_{1}\), _sr_ is the specific role in _domain_\({}_{2}\), and _da_ authorizes _sr_ to user \(u\). This indicates that the domain administrator authorizes the specific role of other domains to users, which violates the inter-domain isolation management. **Proof that RBAC-IC does not meet Formula (39). **  
Assume domain administrator _da_ and user \(u\) exist in _domain_\({}_{1}\), and the specific role _sr_ exists in _domain_\({}_{2}\). _da_ authorizes _sr_ to \(u\), and Formula (39) is established;  
However, RBAC-IC requires that the domain administrator can only authorize the specific roles in the local domain to users;  
Formula (39) does not meet the above rules, and the _authorization_(_da_, \(u\), _sr_) operation cannot be executed;  
It can be proved that RBAC-IC does not meet Formula (39). \(\square\)  
Figure 13 shows an example of cross-domain authorization. Figure 12: There is a dynamic mutual exclusion constraint between \(sr_{1}\) and \(sr_{2}\). The domain administrator _da_ allows to authorizes both \(sr_{1}\) and \(sr_{2}\) roles to user \(u\). However, after \(u\) activates session \(s\), only one of \(sr_{1}\) and \(sr_{2}\) can exist in \(s\); that is, only one of 1 and 2 processes can be executed. Figure 13: The solid line indicates that it is feasible for domain administrator _da_ to authorize the specific role \(sr_{1}\) of local domain to user \(u\). The dotted line indicates that the _da_ authorizes the \(sr_{1}\) of other domains to the \(u\), but it is not feasible. Cross-domain access (Wrong specific roles);  
\[(\textit{sr}[domain]=domain_{1}\ \wedge\ o[domain]=domain_{2})\ \vee\ (\textit{sr}[ \textit{system}]=\textit{system}_{1}\ \wedge\ o[\textit{system}]=\textit{system}_{2})\ \wedge\ s\in \tag{40}\] \[\textit{user\_session}(u)\ \wedge\textit{sr}\in\textit{session\_sr}(s)\ \wedge\ access(u,\textit{sr},o)\]  
where \(\textit{access}(u,\textit{sr},\ o)\) means that user \(u\) uses the specific role \(\textit{sr}\) to access object \(o\). This formula describes that the specific role \(\textit{sr}\) can be used in \(\textit{domain}_{1}\) or \(\textit{system}_{1}\). User \(u\) has activated session \(s\), \(\textit{sr}\) is allowed in \(s\) and \(u\) successfully uses \(\textit{sr}\) to access object \(o\), but \(o\) is stored in a system in \(\textit{domain}_{2}\) or \(\textit{system}_{2}\) in a domain. This indicates that the user has performed an illegal cross-domain operation. When RBAC-IC uses a specific role to access an object, the specific role cannot be different from the domain or system of the target object. Figure 14 shows an example of cross-domain access, which illustrates that RBAC-IC does not satisfy Formula (40). 3. Cross-system access (Wrong permissions);  
\[(\textit{r}[domain]=domain_{1}\ \wedge\ o[domain]=domain_{2})\ \vee\ (\textit{p}[ \textit{system}]=\textit{system}_{1}\ \wedge\ o[\textit{system}]=\textit{system}_{2})\ \wedge\ s\in \tag{41}\] \[\textit{user\_session}(u)\ \wedge\textit{sr}\in\textit{session\_ permission}(s)\ \wedge\ access(u,\textit{p},o)\]  
where \(\textit{access}(u,\textit{p},o)\) indicates that user \(u\) accesses object \(o\) with permission \(p\).