以存取樣本為控制基礎之安全檔案系統

Secure File System Based on Access Pattern Control

柯淑悅(Shu-Yueh Ko)

指導教授 ： 黃士殷

元智大學/資訊學院/資訊工程學系/碩士(2001年)

摘要

本論文研製之具有安全的檔案系統，希望結合公開鑰匙/私人鑰匙、會議交談鑰匙、動態密碼等等相關技術，並取用以角色為基礎之存取控制為架構，再加上存取控制樣本為動態控制存取策略的構想，以增加對檔案系統的安全性。藉由使用XML文件配合多變的網路環境為例，實現存取安全檔案系統的架構。讓此架構下的檔案系統可以擁有安全性、方便性的優勢並達到一更完善之認證/授權的動態存取控制模型。
使用以角色為基礎存取控制模型的中介層。當要求存取檔案系統中檔案時，中介層的存取控制單元必須要根據要求存取行為的使用者角色、權利、甚至對存取時間及次數等等加以考慮。一般來說，用一個具有組織性的存取控制機制來表達使用者對檔案存取擁有的權利已經算是達到安全的目的，但若想要針對檔案系統中的各別檔案作存取控制卻顯得十分地困窘。為了這個解決問題，論文中將對此提出解決方式。並利用規則限制來表達存取權限，以保護文件不被有心人士得到。再利用一個安全檔案中介層負責管理檔案安全傳送與鑰匙交換。最後提出一個處理中介層與客戶端間彼此溝通訊息的演算法及實作，並要求客戶端使用一個特殊檢視器專門負責作解密與檢視文件的動作，以達到一個具動態管理與安全檔案系統。

關鍵字

存取樣本 ； 授權規則語言 ； 以角色為基礎存取控制 ； 鑰匙交換協定 ； XML

並列摘要

A procedure is a based on access pattern approach to secure file system (SFS), using RBAC, Public/Private Key, Session Key, Dynamic password, etc. We propose access pattern based on RBAC to enforce dynamic access control policies. Security policies are expressed as rules depend upon a user’s access history and/or an object’s history of being accessed in order to specify policies for security and management of secure file system. An experience engine is utilized to evaluate policies, dynamically assign authority to user. For the purpose of XML documents, is described allowing for definition and enforcement of access restrictions directly on the structure and content, providing a simple and effective way for user and administrator to protect and to manage information.
Using middleware of SFS to control the request file, it must consider role, operations, even access time and history. In general, it is safe to express authority in the organization. But, it is difficult for manager if want to do particular limit in the organization. In order to solve this problem, we propose a manner to settle relies on access pattern. Again, using middleware, it is to manage policies, transfer file and exchange decrypted key. Finally, we provide negotiation way and algorithm between middleware and viewer. To implement the core of middleware and a special viewer for the client, we could obtain a dynamic management and secure file system.

並列關鍵字

Access pattern ； Authorization rule language ； Role-based access control ； Key exchange protocol ； XML

參考文獻

3.B. Hashii, S. Malabarba, R. Pandey, M. Bishop,” Supporting Reconfigurable Security Policies for Mobile Programs”. http://www9.org/w9cdrom/345/345.html

5.Bruch Schneier, Applied Cryptography,Second Edition. John Wiley & Sons, Inc. 1996.

8.Chung-Huang Yang; Shy-Ming Ju; Rao, T.R.N., “A smartcard-based framework for secure document exchange”. Security Technology, 1998. Proceedings., 32nd Annual 1998 International Carnahan Conference on , 1998 , Page(s): 93 -96

11.Denning, Dorothy E., (Dorothy Elizabeth), Cryptography and Data Security, Addision-Wesley Publishing Company, 1983.

12.Dieter Gollmann, COMPUTER SECURITY, Cambridge, UK, John Wiley & Sons, 1999