A Fine Grained Access Control Model for Relational Databases
A Fine Grained Access Control Model for Relational Databases
复制标题
关系数据库的细粒度访问控制模型
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
Dr. Suresh Jain
中科院分区：
文献类型：
--
作者：
Neha Sehta;Dr. Suresh Jain
目前，大多数商业工作都使用关系数据库管理系统（RDBMS）来存储大量的数据。通过因特网传播信息已成为一项基本要求。SQL中的授权机制允许在完整的表或列级别或视图级别进行访问控制，从而提供粗粒度。没有直接的方法来控制哪些用户可以访问哪些元组。细粒度访问控制（FGAC）是保证数据安全的方法之一。根据需求，细粒度访问控制的粒度可以是目录或文件夹级别、数据库级别、表级别，甚至是单个记录（元组）和数据字段级别。访问控制是将每个请求传递给系统维护的资源和数据，并确定是否应授予或拒绝请求的过程。访问控制决策由实现安全策略所建立的规则的机制强制执行。对应于用于定义什么应该被允许和什么不应该被允许的不同标准，可以定义不同的访问控制策略。提出了一种新的访问控制模型，为授权用户提供对共享数据的细粒度访问控制。在建议的实现中，我们创建了一组元表，用于存储构成安全策略、注册用户及其授权信息的数据。这允许动态地创建（或更改）策略。访问权限以四元组<role，object，operation，policy>的形式存储。政策的任何变化都不会影响应用程序。此外，还支持被定义为一起管理用户访问的多个策略，这有助于对具有多个凭证的用户的平滑访问，而无需他在提出请求时提及他的每个凭证。关键词访问控制策略，数据安全，细粒度访问控制，关系数据库管理系统.
Nowadays most of the commercial work make use of relational database management systems (RDBMS) to store a substantial amount of their data. Accessing information over the Internet has become an essential requirement. Authorization mechanisms in SQL permit access control at the level of complete tables or columns, or on views, providing coarse granularity. There is no direct way to control which tuples can be accessed by which users. Fine Grained Access Control (FGAC) is one of the ways to ensure data security. As per the requirements the granularity of fine grained access control can be on directories or folder level, database level, table level, even on individual record (tuple) and data field level. Access control is the process of mediating every request to resources and data maintained by a system and determining whether the request should be granted or denied. The access control decision is enforced by a mechanism implementing regulations established by a security policy. Corresponding to different criteria for defining what should, and what should not be allowed, different access control policies can be defined. In this paper, a novel access control model is proposed, which provides fine grained access control to shared data to authorized users. In proposed implementation, we have created a set of metatables, to store the data that make up the security policies, registered users and their authorization information. This allows policies to be created (or changed) dynamically. The access permissions are stored in the form of quadruple <role, object, operation, policy>. Any change in policies doesn’t affect the application program. Moreover multiple policies defined to regulate user access together are also supported, which facilitates smooth access to user having multiple credentials without having him to mention each of his credentials at the time he makes request. KeywordsAccess Control Policy, Data Security, Fine Grained Access Control, RDBMS.