一句话：提出基于 GemRBAC+CTX 的模型驱动框架，将 RBAC 访问决策归约为运行时约束满足，并实现工具 MORRO。
现有复杂 RBAC 策略模型虽能表达丰富授权规则，但执行机制往往无法完整支持这些模型可表达的所有策略类型，因而阻碍实践应用。本文以 GemRBAC+CTX 这一综合 RBAC 模型为基础，提出模型驱动的运行时执行框架：将访问决策问题归约为判断从 RBAC 视角表示的系统状态（即 GemRBAC+CTX 模型实例）是否满足待执行策略对应的约束。作者给出针对多种访问请求和事件的执行算法，实现原型工具 MORRO，并说明如何将其集成到工业 Web 应用。评估表明该方法可应用于工业系统，且在访问控制配置参数变化下具有可扩展性。
A Role-based Access Control (RBAC) mechanism prevents unauthorized users to perform an operation, according to authorization policies which are defined on the user’s role within an enterprise. Several models have been proposed to specify complex RBAC policies. However, existing approaches for policy enforcement do not fully support all the types of policies that can be expressed in these models, which hinders their adoption among practitioners. In this paper we propose a model-driven enforcement framework for complex policies captured by GemRBAC+CTX, a comprehensive RBAC model proposed in the literature. We reduce the problem of making an access decision to checking whether a system state (from an RBAC point of view), expressed as an instance of the GemRBAC+CTX model, satisfies the constraints corresponding to the RBAC policies to be enforced at run time. We provide enforcement algorithms for various types of access requests and events, and a prototype tool (MORRO) implementing them. We also show how to integrate MORRO into an industrial Web application. The evaluation results show the applicability of our approach on a industrial system and its scalability with respect to the various parameters characterizing an AC configuration.