MIERA: A Method for Inter-Enterprise Role-Based Authorization

Large-scale deployment of e-commerce solutions between various enterprises over public networks requires careful consideration of security issues. In this paper we will address the particular problem of inter-enterprise authorization, as would be required if, for example, a business process spans several organizations and data is passed among enterprises during the execution of the process. In this paper we propose the MIERA scheme for authorization, which can be used for both intra- or inter-enterprise authorization. MIERA makes authorization decisions based on roles, which are represented by anonymous role certificates. We also define an authorization tree A(T) for a transaction of type T that determines what combination of roles can authorize transactions of type T. In the case of inter- enterprise authorization, we can use a hashed version of A(T) to reduce space requirements and also to obscure the decision procedure information in A(T), but which still permits transactions of type T to be authorized.