以角色為基礎的權限控管系統間角色對應問題之研究與探討

A Study of Inter-Domain Role Mapping in Role-Based Access Control System

汪至仁(Chih-Jen Wang)

指導教授 ： 留忠賢

中原大學/工學院/資訊工程研究所/碩士(2007年)

https://doi.org/10.6840/cycu200700590

摘要

本篇論文探討以角色為基礎的權限控管系統（RBAC system）之間角色對應（role mapping）的問題。因為在RBAC中角色是屬於一個授權的中介者，必須透過角色才能取得權限，因此當使用者需要使用不同的RBAC domain的資源時，必須取得不同RBAC domain的角色，以便獲得相對的權限。所以角色對應的問題就在於處理RBAC domains之間的角色要如何對應才可以取得想要之權限。
我們提出一個角色對應的方法來解決不同RBAC domain之間角色對應的問題。我們採用權限要求（permission request）的概念來做為角色對應時的基礎，並且盡可能產生最少數目的暫時性角色（temporary role）來獲得不同RBAC domain中的權限。我們提出的方法可以確保在hybrid role hierarchy時角色對應的一致性，並且不會改變各個RBAC domain的原有role hierarchy。

關鍵字

interoperation ； Multi-Domain ； RBAC ； 角色對應

並列摘要

In this thesis, we explored the role mapping problem between different RBAC systems. Because in an RBAC system, users obtain permissions through the assignment of roles, a user must be assigned a role from other RBAC domains to use the corresponding resources. Therefore one major problem in integrating RBAC domains was to map a role to other domains to obtain desired authorizations in other domains.
We proposed a method for role mapping between different RBAC domains. We used permission request concept as basis for role mapping and attempted to produce the least number of temporary roles when acquiring the authorization from different RBAC domains. Our method can assure the consistency of role mapping in a hybrid role hierarchy without changing the role hierarchy in each RBAC domain.

並列關鍵字

interoperation ； Multi-Domain ； RBAC ； Role Mapping

參考文獻

[3] James B.D. Joshi, Elisa Bertino, Usman Latif, and Arif Ghafoor, “A Generalized Temporal Role-Based Access Control Model,” IEEE Transactions on Knowledge And Data Engineering, Vol. 17, No. 1, January 2005, p.4-23.

[4] Apu Kapadia, Jalal Al-Muhtadi, R.Campbell, and D. Mickunas,　“IRBAC 2000: Secure Interoperability Using Dynamic Role Translation,” The 1st International Conference on Internet Computing, June 26th - 29th, 2000,Monte Carlo Resort, Las Vegas, Nevada, USA.

[6] Axel Kern, Andreas Schaad, and Jonathan Moffett, “An Administration Concept for the Enterprise Role-Based Access Control Model,” SACMAT’03, June 2-3, 2003, Como, Italy, p.3-11

[7] Michael J. Convington, Matthew J. Moyer, and Mustaque Ahamed, “Generlized Role-Based Access Control for Securing Future Application,” In Proceedings of the National Information Systems Security Conference (NISSC), October, 2000. Also Appeared as technical report GIT-CC-00-02, available from the Georgia Tech College of Computing.　

[8] L. Gong and X. Qian, “Computational Issues in Secure Interoperation,” IEEE Trans. Software Eng., vol. 22, no. 1, Jan. 1996.