TC: Usage Control Models, Architectures and Mechanisms Based on Integrating Authorizations, Obligations and Conditions

摘要本课题旨在开发一种新的网络空间信息和系统资源保护方法——使用控制。除了传统的授权概念（访问通过显式或隐式许可和权利进行授权）之外，使用控制还包括义务（在访问之前和访问期间必须满足的条件）和条件（环境和系统条件）。使用控制进一步承认访问强制的连续性，因此允许访问的决定不仅在访问之前做出，而且在访问进行时也要做出。最后，使用控制认识到需要可变性，因此需要在访问进行时更新适当的属性。该项目将开发、完善和形式化使用控制模型。它将考虑医疗保健、数字版权管理和电子商务领域的应用。同时，它还将研究实施使用控制的体系结构。本研究旨在为增强经典访问矩阵模型的各种建议提供清晰度和智力凝聚力。这种知识基础将反过来促进更多的基础和应用研究。这项研究的结果正在GMU现有的课程中讲授。这些结果将影响和塑造下一代访问控制系统。

AbstractThis project is developing a new approach called usage control to protectionof information and system resources in cyberspace. In addition to thetraditional concept of authorization (whereby access is authorized byexplicit or implicit permissions and rights), usage control includesobligations (conditions which must be met before and during access) andconditions (environmental and system conditions). Usage control furtherrecognizes continuity of access enforcement so the decision to allow accessis not only made prior to access, but also while the access is underway.Finally, usage control recognizes the need for mutability wherebyappropriate attributes need to be updated as access proceeds. This projectwill develop, refine and formalize models for usage control. It willconsider applications from healthcare, digital rights management andelectronic commerce domains. Concurrently it will investigate architecturesfor enforcing usage control. This research seeks to give clarity andintellectual cohesion to a variety of proposals to enhance the classicaccess matrix model. This intellectual foundation will in turn fosteradditional basic and applied research. The results of this research are beingtaught in existing GMU courses as they emerge. These results will influenceand shape the next generation of access control systems.