Access control in publish/subscribe systems
Access control in publish/subscribe systems
复制标题
DOI：
10.1145/1385989.1385993
复制
发表时间：
2008-07
期刊：
影响因子：
--
通讯作者：
J. Bacon;D. Eyers;Jatinder Singh;P. Pietzuch
中科院分区：
文献类型：
--
作者：
J. Bacon;D. Eyers;Jatinder Singh;P. Pietzuch
为了在广泛分布的系统中实现可伸缩性，出现了两种令人信服的范例：发布/订阅通信和基于角色的、策略驱动的应用程序对系统的访问控制。发布/订阅的一个优点是它的多对多通信范例和组件的松散耦合，因此发布者不需要知道其数据的接收者，订阅者也不需要知道发布者的数量和位置。但有些数据是敏感的，出于个人和法律原因，必须仔细控制其可见性。我们描述了几个应用程序领域的需求，在这些领域中，基于事件的范例是合适的，但在安全性是一个问题的情况下。典型的是政府和公共机构在医疗保健、警察、交通和环境监测等领域所需的大规模系统。我们将讨论如何保护发布/订阅服务；首先是通过在服务API中指定和实施访问控制策略，其次是通过在服务网络本身中实施这些策略的安全和隐私方面。最后，我们描述了一种全消息加密的替代方案，适用于发往具有不同要求的特定域的高度敏感和长期存在的数据。我们概述了我们在这些领域的几个研究项目的调查和发现。
Two convincing paradigms have emerged for achieving scalability in widely distributed systems: publish/subscribe communication and role-based, policy-driven control of access to the system by applications. A strength of publish/subscribe is its many-to-many communication paradigm and loose coupling of components, so that publishers need not know the recipients of their data and subscribers need not know the number and location of publishers. But some data is sensitive, and its visibility must be controlled carefully for personal and legal reasons. We describe the requirements of several application domains where the event-based paradigm is appropriate yet where security is an issue. Typical are the large-scale systems required by government and public bodies for domains such as healthcare, police, transport and environmental monitoring. We discuss how a publish/subscribe service can be secured; firstly by specifying and enforcing access control policy at the service API, and secondly by enforcing the security and privacy aspects of these policies within the service network itself. Finally, we describe an alternative to whole-message encryption, appropriate for highly sensitive and long-lived data destined for specific domains with varied requirements. We outline our investigations and findings from several research projects in these areas.