以角色為主之權限控管系統中使用控制模組之研究與實作

A Study of Usage Control Model in Role-Based Access Control System

曾瑋展(Tseng-Wei Chan)

指導教授 ： 留忠賢

中原大學/工學院/資訊工程研究所/碩士(2005年)

https://doi.org/10.6840/cycu200500269

摘要

傳統RBAC系統中，系統會存放各個使用者所擁有角色的清單，當使用者進入系統前會去做Authorization的檢查，讓使用者得到其所擁有的權限。但是Authorization對現今有些系統略嫌不足，所以加入了使用控制(Usage Control)模組，它允許「Authorization」、「Obligation」和「Condition」三種決定策略去檢查權限，Obligation是因為現有些系統有些需要使用者做某些事才能取得權限，而且有些權限的取得也會加上Condition的限制。使用控制也提供了和「連續執行」和「可變性」二種特性，讓使用者能在系統執行中去重新判斷使用者所能使用的角色。如線上付費系統，使用者擁有的金額必須大於所想購買的權限，像閱讀一本書，在閱讀期間也許權限到期了，系統會再詢問使用者是否繼續付費，讓使用者選擇是否繼續閱讀。
本篇論文主要是討論在一個RBAC權限系統中，加入Usage Control模組並且實作出一個能即時檢查權限的系統。主要包含：(1)系統管理者介面：提供一個介面讓系統管理者方便管理所有的使用者屬性表，(2)屬性更新：在執行系統功能前、行進中、結束這三段時間去更新屬性，(3)動態權責分離：在執行功能中，藉由屬性改變而
讓使用者無法同時使用互斥的角色。

關鍵字

UCON ； 使用控制 ； 存取控制 ； RBAC

並列摘要

In traditional RBAC systems, a user’s access rights will be checked and authorized before system resources can be used. But this is not enough in some situations, so that the concepts of usage control were introduced. Usage control allows three kinds of authorization decisions: authorization, obligation and condition. Obligation means that a user needs to do some things to get access rights, and conditions may be used to restrict a user’s access rights. There are also mutable property and continuity property in usage control. Thus, the roles that a user can use can be decided at runtime. For example, in an on-line service system, a user must have more cash in order to obtain the read service. Like reading a book, and system will ask the user to pay more in order to continue reading when the access rights expire.
In this thesis, we studied on how to integrate usage control model into a role-based access control system, and implemented a system for checking user’s rights at runtime. The implementation includes (1) an administrator's interface to help the administrator to manage users and their attributes, (2) attributes update that allows pre-update, ongoing-update and post-update of user’s attributes, and (3) dynamic separation of duty to check the values of user’s attributes to prevent a user from holding exclusive roles at the same time.

並列關鍵字

Access Control ； UCON ； RBAC ； Usage Control

參考文獻

"Role-Based Access Control Models." IEEE Computer, Volume 29,

[3]. Ravi S. Sandhu, Venkata Bhamidipati, Qamar Munawer, "The ARBAC97 Model for Role-Based Administration of Roles, " ACM Transactions on Information and System Security (TISSEC), p. 105 – 135, 1999

[5]. Jaehong Park and Ravi S. Sandhu. "Towards Usage Control Models: Beyond Traditional Access Control," In Proceedings of 7th ACM Symposium on Access Control Models and Technologies June 2002.

[6]. Andreas Schaad and Jonathan D. Moffett. "A Lightweight Approach to Specification and Analysis of Role-based Access Control Extensions," In Proceedings of 7th ACM Symposium on Access Control Models and Technologies. June 2002.

[9]. Jaehong Park, Ravi S. Sandhu, "The UCONABC usage control model," ACM Transactions on Information and System Security (TISSEC), p. 128 – 174, 2004.