Optimal workflow-aware authorizations
Optimal workflow-aware authorizations
复制标题
最佳工作流程感知授权
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
G. Karjoth
中科院分区：
文献类型：
--
作者：
D. Basin;Samuel J. Burri;G. Karjoth
在指定授权时，平衡保护和授权是一个中心问题。最小特权原则是平衡这两个相互冲突的目标的经典方法，它规定用户只能被授权执行完成其工作所需的任务。然而，当存在多种满足最小权限的授权策略时，应该选择哪一种呢？
在本文中，我们将用户必须执行的任务建模为工作流，以及与授权策略及其管理相关的风险和成本。然后，我们将授权和保护的平衡制定为优化问题：找到允许成功执行工作流的成本最小化授权策略。我们证明，为基于角色的成本函数找到最优解决方案是 NP 完全的。我们通过一系列示例来支持我们的结果，我们也用这些示例来衡量原型实现的性能。
Balancing protection and empowerment is a central problem when specifying authorizations. The principle of least privilege, the classical approach to balancing these two conflicting objectives, says that users shall only be authorized to execute the tasks necessary to complete their job. However, when there are multiple authorization policies satisfying least privilege, which one should be chosen?
In this paper, we model the tasks that users must execute as workflows, and the risk and cost associated with authorization policies and their administration. We then formulate the balancing of empowerment and protection as an optimization problem: finding a cost-minimizing authorization policy that allows a successful workflow execution. We show that finding an optimal solution for a role-based cost function is NP-complete. We support our results with a series of examples, which we also use to measure the performance of our prototype implementation.