On Desing of Access Control for Database Systems

集中控制用户对数据库系统的访问权限是解决这一问题的途径之一。该方法的一个系统模型称为安全模型。典型的安全模型是Bell和Lapadula模型(摘要BLP)的强制模型和使用访问矩阵的自由模型。BLP是为信息和用户定义的安全级别。通过比较用户和信息的安全级别来控制用户的访问权限。信息流的方向由安全级别来定义。另一方面，使用访问矩阵和访问矩阵的自由模型具有能够环视整个用户的信息流的优点。但有一个问题是，间接信息流是由于将任何信息写入其他信息而导致的，从而破坏了信息的机密性和完整性。如果访问权限发生更改，我们将面临进一步的问题，即…更详细地说，在更改访问权限之前一直是安全的访问矩阵是不安全的。本研究提出了一种安全模型和具体化方法来检测间接信息流，验证信息是否安全。对于所提出的安全模型，定义了一个层次时间Petri网(H-TPN)，它是层次时间Petri网的扩展。在层次Petri网中引入了H-TPN的时间参数和有色标记。接入矩阵中的信息流由H-TPN上的路径描述，路径的位置描述用户和信息。在H-TPN的转移中定义了时间参数，引入了两类有色令牌来降低令牌传播路径的复杂度，一类描述待验证的信息，另一类描述未验证的信息。定义了有色令牌之间的运算规则，在所提出的安全模型中，我们将展示关于时间的安全的非常有趣的性质。属性是直到某一时间的安全条件和从某一时间到某一未来时间的安全条件。较少

To control the access right of users to data base systems concentrically is one of the approaches for solving to the problem. A systematic model for the approach is called the security model. Typical security models are a mandatory model of the Bell and LaPadula model (summarize BLP) and a discretionaly model using an access matrix. The BLP is defined security levels for information and users. An access right of users is controlled by comparing the security levels of the users and the information. Direction of the information flows are defined by the security levels.On the other haid, the discretionaly model using an access matrix an access matrix has an advantage to be able to look aroud information flows all over the users. But there is a problem that the indirect information flows are caused by writing any information to the other information, and consequently, confidentiality and integrity for the information are damaged. And if access right is changed, we have a further problem th … More at the access matrix which has been secure before changing access right is not secure. But reports of this type of research have apparently not been published to date.This research proposes a security model and reification method to detect the indirect information flows and to verify whether information is secure or not. For the security model proposed, a Hierarchical Time Petri Net (H-TPN), which is an extended not of the Hierarchical Petri Net, is defimed. The H-TPN is introduced time parameter and colored tokens in the Hierarchical Petri Net. The information flows in the access matrix are described by the paths on the H-TPN whose places describe users and information. The time parameter is defined in the transitions of the H-TPN.Colored tokens, which are divided into two types, are introduced to reduce complexity of toke'n propagation paths, The one type of the colored tokens describes information to be verified, the others describe information not to be verified. Operation rules between colored tokens are defined.In the proposed security model, we will show very interesting properties for the security with regard to the time. The properites are a condition to be secure till a certain time and a condition to be secure from a certain time to a certain future time. Less