Entity-Based Access Control: supporting more expressive access control policies
Entity-Based Access Control: supporting more expressive access control policies
复制标题
基于实体的访问控制：支持更具表现力的访问控制策略
DOI：
10.1145/2818000.2818009
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
W. Joosen
中科院分区：
文献类型：
--
作者：
J. Bogaerts;Maarten Decat;B. Lagaisse;W. Joosen
访问控制是安全性的重要组成部分，它限制用户可以对资源执行的操作。策略模型指定如何在策略中制定这些限制。在过去的几十年里，我们已经看到了几个这样的模型，包括基于角色的访问控制和最近的基于属性的访问控制。然而，这些模型没有考虑用户、资源和实体之间的关系及其相应的属性。这限制了这些模型的表现力。在这项工作中，我们提出了基于权限的访问控制（EBAC）。EBAC引入实体作为主要概念，并考虑属性和关系来评估策略。此外，我们还提供Auctoritas。Auctoritas是一个授权系统，为EBAC提供了一个实用的策略语言和评估引擎。我们发现，EBAC增加了政策的表现力，适合应用领域。此外，我们的评估表明，Auctoritas中描述的基于实体的政策可以执行低的政策评估延迟。
Access control is an important part of security that restricts the actions that users can perform on resources. Policy models specify how these restrictions are formulated in policies. Over the last decades, we have seen several such models, including role-based access control and more recently, attribute-based access control. However, these models do not take into account the relationships between users, resources and entities and their corresponding properties. This limits the expressiveness of these models. In this work, we present Entity-Based Access Control (EBAC). EBAC introduces entities as a primary concept and takes into account both attributes and relationships to evaluate policies. In addition, we present Auctoritas. Auctoritas is a authorization system that provides a practical policy language and evaluation engine for EBAC. We find that EBAC increases the expressiveness of policies and fits the application domain well. Moreover, our evaluation shows that entity-based policies described in Auctoritas can be enforced with a low policy evaluation latency.