Policy Analysis for Self-administrated Role-Based Access Control
Policy Analysis for Self-administrated Role-Based Access Control
复制标题
基于角色的自我管理访问控制的策略分析
DOI：
10.1007/978-3-642-36742-7_30
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
G. Parlato
中科院分区：
文献类型：
--
作者：
A. L. Ferrara;P. Madhusudan;G. Parlato
目前的技术，基于管理角色的访问控制（ARBAC）策略的安全性分析限制自己的独立管理的假设，基本上从常规的分离管理角色。跟踪所有用户的朴素算法是在没有单独管理的情况下分析ARBAC策略的唯一已知算法，并且这导致的状态空间爆炸排除了构建有效工具的可能性。相反，单独管理的假设大大简化了分析，因为它使得一次只跟踪一个用户就足够了。然而，分离限制了模型的表达能力并限制了分布式管理控制的建模。我们进行了一个基本的研究分析的ARBAC政策没有单独的管理限制，并表明，分析算法可以建立，跟踪只有有限数量的用户，其中的约束只取决于系统中的管理角色的数量。使用这个基本的见解铺平了道路，为我们设计一个涉及启发式，以进一步驯服在实际系统中的状态空间爆炸。我们的研究结果也是非常有效的，当应用于单独的管理限制下设计的政策。我们实现我们的技术和报告进行了几个现实的案例研究的实验。
Current techniques for security analysis of administrative role-based access control (ARBAC) policies restrict themselves to the separate administration assumption that essentially separates administrative roles from regular ones. The naive algorithm of tracking all users is all that is known for the analysis of ARBAC policies without separate administration, and the state space explosion that this results in precludes building effective tools. In contrast, the separate administration assumption greatly simplifies the analysis since it makes it sufficient to track only one user at a time. However, separation limits the expressiveness of the models and restricts modeling distributed administrative control. We undertake a fundamental study of analysis of ARBAC policies without the separate administration restriction, and show that analysis algorithms can be built that track only a bounded number of users, where the bound depends only on the number of administrative roles in the system. Using this fundamental insight paves the way for us to design an involved heuristic to further tame the state space explosion in practical systems. Our results are also very effective when applied on policies designed under the separate administration restriction. We implement our techniques and report on experiments conducted on several realistic case studies.