干旱区生态环境知识资源中心

Various role-based access control (RBAC) models have evolved along with a small number of implementations. One approach is to make role assignment persistent. After authentication, a principal can exercise the privileges associated with the roles it is assigned to without further action. Another approach is that principals must activate roles explicitly when they need to exercise the privileges associated with the roles. In this paper we outline our models and implementations (PER-MIS and OASIS), which provide an example of each style of system. Both are concerned with realistic implementations in large-scale, widely distributed systems. We discuss the advantages and disadvantages of persistent versus dynamic role membership.