以角色為基礎之權限控管系統對權限和安全等級研究與探討

在一個以角色為主的權限控管 (RBAC)系統中，如何有效的減少不必要的角色對於降低系統複雜度是很重要的。隨著組織日益龐大和工作流程的日益複雜，會使角色和權限增加，而使得維護和設計的工作更為困難。在一個階層式RBAC中，上層角色會繼承下層角色的權限。但在實際狀況中，由於不同工作流程和其它安全限制，上層角色不一定能夠擁有下層角色的權限，因此繼承可能需要有範圍限制。我們將物件導向的觀念融入設計中，將系統權限依使用範圍分類。我們的角色繼承方式可以限制特定權限的使用範圍，並以安全等級來表示，所以特定權限不會無條件的往上繼承，也不用產生新的角色來處理不能繼承的權限。此方法簡單且可減少角色數量。

關鍵字

繼承；安全等級；使用範圍； RBAC

並列摘要

It is important to reduce unnecessary roles to reduce the complexity of an RBAC system. In a large enterprise with complex workflows, there are large number of roles and permissions that are difficult to manage and design. In a hierarchical RBAC system, senior roles inherit junior roles’ permissions. But in real world, it is possible that a senior role can not have all the permissions of its junior roles, due to different tasks performed or other security constraints. Thus, it is desirable to define the scope of permission inheritance. We proposed to use object-oriented concepts to classify permissions by their scopes. The scope of a permission is specified by both inheritance and security level. Therefore, a permission can not be inherited unconditionally. We do not need to create more roles to handle permissions that can not be inherited. This method is simple and can reduce role number.

並列關鍵字

inherited ； security level ； RBAC ； scope

參考文獻

[1]Joon S. Park and Junseok Hwang, “Role-based Access Control for Collaborative Enterprise In Peer-to-Peer Computing Environments”, SACMAT’03, June 2-3, 2003, 93-99

[2] J. Joshi et al., “A Generalized Temporal Role-Based Access Control Model”, IEEE Transactions on Knowledge and Data Engineering, VOL. 17, NO. 1, January 2005

[3] Gustavo H. M. B.Motta and Sergio S. Furuie, “A Contextual Role-Based Access Control Authorization Model for Electronic Patient Record”, IEEE Transactions on Information Technology in Biomedicine, VOL. 7, NO. 3, September 2003

[4] Sylvia Osborn, “Mandatory Access Control and Role-Based Access Control Revisited”, in Proceedings of the 2nd ACM workshop on Role-based access control, 1997, 31-40

[6] David Ferraiolo et al., “Proposed NIST Standard for Role-Based Access Control”, ACM Transactions on Information and System Security, VOL. 4, NO. 3, August 2001, 224-274

國際替代計量

以角色為基礎之權限控管系統對權限和安全等級研究與探討

全文下載

主題瀏覽