適用於網路服務之高效率整合式存取控制系統設計與實作

Design and Implementation of Integrated Access Control Systems with High Efficiency for Web Services

曹偉駿(Woei-Jiunn Tsaur) ； 黃美治(Mei-Zhi Huang)

《管理與系統》 17卷1期 (2010/01) Pp. 159-182

摘要

網路服務技術是一個幫助企業降低營運成本並提高獲利極爲有效的資訊系統架構。但隨著交易環境的多元化，訊息內容的安全與如何有效執行存取控制，將成爲網路服務環境下一大課題。目前網路服務環境的安全需求中，多採用憑證爲基礎的公開金鑰密碼系統來解決相關的問題，這使得在身份驗證及管理上具有相當的複雜度。而在現行存取控制的方法上可分爲二大類。第一類是由使用者分別向不同的網路服務站台註冊以取得相關服務，但此方法的缺點爲，系統管理者必須持續爲短暫需求使用者建立使用權限；第二類則是使用者向單一站台註冊，而站台之間以鬆散偶合(Loosely Coupled)的方式連結，但此方法卻也有不同網域對於使用權限認定不一致的問題。因此，本論文基於低運算量之「植基於ECC的自我認證公開金鑰密碼系統」與角色爲基礎的存取控制方式，建構出具有高效率的整合式存取控制系統。是故，本系統能在不使用憑證的狀況下做到使用者身份識別，同時在不影響現行企業內部存取控制的前提下，解決跨網域存取權限不一的問題。此外，與現行存取控制進行比較後發現，本系統不論在安全性與效率上都有較優的表現。相信本系統應用在企業網路服務上，將可降低維護成本並且有效減輕系統管理者負擔，進而提升存取效率。

關鍵字

角色爲基礎的存取控制 ； 橢圓曲線密碼系統 ； 自我驗證公開金鑰密碼系統 ； 資訊安全

並列摘要

Web services technology is an extreme efficient structure of information system for promoting enterprises to lower operating cost and raise profits. Nevertheless, with the pluralism of trading platforms, the security of transmitting message and how to execute the access control for information systems will become an important issue for securing the web service environment. Using certificate-based public key cryptosystems to solve the problems related to the demand of security under the current environment of web services causes rather complicated identity verifying and management. The methods of access control in operation can be divided into two kinds. One is that each user must register at different web sites, and therefore the system administrator will be busy in establishing the authority connection for these users; the other is at one specific web site, but every single site is connected with the others through the way of ”loosely coupled”, but user may face the problem of different level of authority from a variety of web domains. For this reason, in this paper the mechanism of integrated access control with high efficiency is constructed using the ECC-based self-certified public key cryptosystems and role-based access control scheme. The proposed mechanism can identify the user without employing certificates, and solve the limits of access authority across different web domains without any influence upon current system operations. Furthermore, after the comparisons with the current access control schemes for web services, we can find the proposed one will be superior to the others in terms of security and efficiency. We affirm that the proposed scheme will be able to lower the cost of maintenance and lighten the burden of system administrator, and thus promote the efficiency of access control to web services environments.

並列關鍵字

Role-Based Access Control ； Elliptic Curve Cryptosystems ； Self-certified Public Key Cryptosystems ； Information Security

參考文獻

曹偉駿(2003)。發展電子商務系統網路之安全基礎環境。管理與系統。10(2)，343-364。

Coetzee, M.,Eloff, J. H. P.(2004).Towards Web Service Access Control.Computers & Security.23(7),559-570.

Coetzee, M.,Eloff, J. H. P.(2005).An Access Control Framework for Web Services.Information Management & Computer Security.13(1),29-38.

Ferraiolo, D.,Kuhn, R.(1992).Proceedings of the 15th NIST – NCSC National Computer Security Conference.Elsevier Advanced Technology Publications.

Girault, M.,D. W. Davies (Eds.)(1991).Advances in Cryptology: EuroCrypt'91, Lecture Notes in Computer Science.Berlin:Springer-Verlag.