TC: Usage Control Models, Architectures and Mechanisms Based on Integrating Authorizations, Obligations and Conditions

摘要本项目正在开发一种名为使用控制的新方法来保护网络空间中的信息和系统资源。除了传统的授权概念(通过明确或隐含的许可和权利授权访问)，使用控制还包括义务(访问之前和访问期间必须满足的条件)和条件(环境和系统条件)。使用控制还认识到访问强制的连续性，因此允许访问的决定不仅在访问之前做出，而且在访问进行中也是如此。最后，使用控制认识到可变性的需要，其中随着访问的进行，需要通过适当的属性来更新。该项目将开发、改进和形式化使用控制模型。它将考虑来自医疗保健、数字版权管理和电子商务领域的申请。同时，它将调查实施使用控制的体系结构。这项研究旨在为增强经典获取矩阵模型的各种建议提供清晰度和智力凝聚力。这种智力基础将反过来促进更多的基础和应用研究。这项研究的结果一旦出现，就会在GMU现有的课程中传授。这些结果将影响和塑造下一代访问控制系统。

AbstractThis project is developing a new approach called usage control to protectionof information and system resources in cyberspace. In addition to thetraditional concept of authorization (whereby access is authorized byexplicit or implicit permissions and rights), usage control includesobligations (conditions which must be met before and during access) andconditions (environmental and system conditions). Usage control furtherrecognizes continuity of access enforcement so the decision to allow accessis not only made prior to access, but also while the access is underway.Finally, usage control recognizes the need for mutability wherebyappropriate attributes need to be updated as access proceeds. This projectwill develop, refine and formalize models for usage control. It willconsider applications from healthcare, digital rights management andelectronic commerce domains. Concurrently it will investigate architecturesfor enforcing usage control. This research seeks to give clarity andintellectual cohesion to a variety of proposals to enhance the classicaccess matrix model. This intellectual foundation will in turn fosteradditional basic and applied research. The results of this research are beingtaught in existing GMU courses as they emerge. These results will influenceand shape the next generation of access control systems.