Role-based access control: database systems research

基于角色的访问控制：数据库系统研究

• 批准号: 3051-2007
• 负责人: Osborn, Sylvia
• 金额: $ 1.82万
• 依托单位: University of Western Ontario
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2007
• 资助国家: 加拿大
• 起止时间: 2007-01-01 至 2008-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=365280
• 关键词: Role; based; access; control; database

The overall goal of this research is to provide theory and tools to help users manage access control in complex computer systems.  Access control is the ability provided in a computing system to say who can do what operations on what data.  This research does not involve cryptography, nor does it involve users identifying themselves to a computer system (this is called user authentication).  Access control takes over once the user has been validated to decide what that user is allowed to do, read and write.  In a complex computer environment, this can be a complex management task.Our research in access control primarily concerns the paradigm of role-based access control (RBAC).  This access control model can be applied to any large, complex system, and can simulate the traditional access control models:  both mandatory access control which is typical of military systems, and discretionary access control which is typically found in commercial database system and operating systems.  As well, complex combinations of access rights can be expressed as roles, which can then be assigned to users or groups of users.Our more recent research has involved how to administrate complex access control systems, specifically RBAC systems.  The original RBAC models assumed a single "super-user" administrator controlling the whole system.  It is more realistic to have a model which allows multiple administrators to manage different aspects of a company's resources.  Our decentralized administrative model is designed to allow for such multiple points of control.  It is even possible for a human resources person to assign users to roles, while a security-knowledgeable person can design the roles and how they are related.The scientific approach in this type of research is to develop a model, prove properties of the model, and develop prototypes and tools to demonstrate the model.  The main contribution of the research will be a better understanding of what access control mechanisms can express, and how to better use them.  Any technology which helps the user community to better secure its information systems is a valuable contribution.

这项研究的总体目标是提供理论和工具，帮助用户管理复杂计算机系统中的访问控制。访问控制是计算系统中提供的能力，可以说谁可以对什么数据做什么操作。这项研究不涉及密码学，也不涉及用户向计算机系统识别自己（这被称为用户认证）。一旦用户被验证以决定允许该用户做什么、读和写，访问控制就接管。在复杂的计算机环境中，这可能是一个复杂的管理任务。我们在访问控制方面的研究主要涉及基于角色的访问控制（RBAC）范式。这种访问控制模型可以应用于任何大型、复杂的系统，并且可以模拟传统的访问控制模型：无论是军事系统中典型的强制访问控制，还是商业数据库系统和操作系统中典型的自主访问控制。同样，访问权限的复杂组合可以表示为角色，然后可以将其分配给用户或用户组。我们最近的研究涉及如何管理复杂的访问控制系统，特别是RBAC系统。最初的RBAC模型假设单个“超级用户”管理员控制整个系统。更现实的是有一个模型，允许多个管理员管理公司的不同方面。资源。我们的去中心化管理模型旨在允许这样的多个控制点。甚至可以由人力资源人员为用户分配角色，而安全知识渊博的人员可以设计角色以及它们之间的关系。这种类型的研究的科学方法是开发模型，证明模型的属性，并开发原型和工具来演示模型。研究的主要贡献将是更好地理解访问控制机制可以表达什么，以及如何更好地使用它们。任何帮助用户社区更好地保护其信息系统的技术都是有价值的贡献。