Supporting relationships in access control using role based access control
Supporting relationships in access control using role based access control
复制标题
使用基于角色的访问控制支持访问控制中的关系
DOI：
10.1145/319171.319177
复制
发表时间：
1999
期刊：
影响因子：
--
通讯作者：
Jinny Uppal
中科院分区：
文献类型：
--
作者：
John F. Barkley;K. Beznosov;Jinny Uppal
基于角色的访问控制（RBAC）模型和机制已被证明是有用和有效的。这从商业产品中的许多RBAC实现中可以清楚地看出。然而，在许多常见的例子中，访问决策必须包括其他因素，特别是实体之间的关系，例如用户、要访问的对象和对象中包含的信息的主题。使用集中管理的传统静态安全属性通常不能有效地表示这种关系。此外，将RBAC模型扩展为包括关系模糊了基本的RBAC隐喻。本文进一步的概念，用于访问控制的关系，它显示了如何关系可以支持基于角色的访问决策使用对象管理组（OMG）的资源访问决策设施（RAD）。此功能允许关系信息（可作为正常应用程序处理的一部分动态更改）用于应用程序的访问决策。通过使用RAD，访问决策逻辑与应用逻辑分离。此外，RAD允许将来自不同模型的访问决策逻辑组合成单个访问决策。因此，每个访问控制模型都能够保留其隐喻。
The Role Based Access Control (RBAC) model and mechanism have proven to be useful and effective. This is clear from the many RBAC implementations in commercial products. However, there are many common examples where access decisions must include other factors, in particular, relationships between entities, such as, the user, the object to be accessed, and the subject of the information contained within the object. Such relationships are often not efficiently represented using traditional static security attributes centrally administered. Furthermore, the extension of RBAC models to include relationships obscures the fundamental RBAC metaphor. This paper furthers the concept of relationships for use in access control, and it shows how relationships can be supported in role based access decisions by using the Object Management Group’s (OMG) Resource Access Decision facility (RAD). This facility allows relationship information, which can dynamically change as part of normal application processing, to be used in access decisions by applications. By using RAD, the access decision logic is separate from application logic. In addition, RAD allows access decision logic from different models to be combined into a single access decision. Each access control model is thus able to retain its metaphor.