The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- thoug...The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- though a number of policy integration and sec- urity analysis mechanisms have been devel- oped, few focus on enabling the average ad- ministrator by providing an intuitive cognitive sense about the integrated policies, which considerably undermines the usability factor. In this paper we propose a visualization flame- work for inter-domain access control policy integration, which integrates Role Based Ac- cess Control （RBAC） policies on the basis of role-mapping and then visualizes the inte- grated result. The role mapping algorithm in the framework considers the hybrid role hier- archy. It can not only satisfy the security con- straints of non-cyclic inheritance and separa- tion of duty but also make visualization easier. The framework uses role-permission trees and semantic substrates to visualize the integrated policies. Through the interactive policy query visualization, the average administrator can gain an intuitive understanding of the policy integration result.展开更多
针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Per...针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Permission Mapping Mechanism),该模型基于向量化与度量化算子的复合运算,提出了度量角色的概念,并以其为授权粒度对委托约束机制进行讨论,增强了权限传播的可控性.最后,通过三个典型的支持细粒度委托的模型在映射机制下的具体实现,验证了RDBMPM模型的研究意义.展开更多
针对现有基于角色访问控制的缺陷和分布式工作流管理系统的特性,在传统的基于角色的访问控制模型中引入任务集(Tasks)、任务实例集(TaskInstances)和任务上下文(TaskContext)的概念,将传统的user role permission权限赋予结构修改为user...针对现有基于角色访问控制的缺陷和分布式工作流管理系统的特性,在传统的基于角色的访问控制模型中引入任务集(Tasks)、任务实例集(TaskInstances)和任务上下文(TaskContext)的概念,将传统的user role permission权限赋予结构修改为user role task permission权限赋予结构,建立了基于任务和角色的访问控制模型,给出了其形式化定义。该模型解决了传统的基于角色访问控制中的动态适应性差和最小权限约束假象的问题,用于分布式工作流管理系统,提高了安全性、实用性。展开更多
基金supported in part by National Key Basic Research Program of China (973 Program) under Grant No.2013CB329603National Natural Science Foundation of China under Grant No.60903191
文摘The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- though a number of policy integration and sec- urity analysis mechanisms have been devel- oped, few focus on enabling the average ad- ministrator by providing an intuitive cognitive sense about the integrated policies, which considerably undermines the usability factor. In this paper we propose a visualization flame- work for inter-domain access control policy integration, which integrates Role Based Ac- cess Control （RBAC） policies on the basis of role-mapping and then visualizes the inte- grated result. The role mapping algorithm in the framework considers the hybrid role hier- archy. It can not only satisfy the security con- straints of non-cyclic inheritance and separa- tion of duty but also make visualization easier. The framework uses role-permission trees and semantic substrates to visualize the integrated policies. Through the interactive policy query visualization, the average administrator can gain an intuitive understanding of the policy integration result.
文摘针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Permission Mapping Mechanism),该模型基于向量化与度量化算子的复合运算,提出了度量角色的概念,并以其为授权粒度对委托约束机制进行讨论,增强了权限传播的可控性.最后,通过三个典型的支持细粒度委托的模型在映射机制下的具体实现,验证了RDBMPM模型的研究意义.
文摘针对现有基于角色访问控制的缺陷和分布式工作流管理系统的特性,在传统的基于角色的访问控制模型中引入任务集(Tasks)、任务实例集(TaskInstances)和任务上下文(TaskContext)的概念,将传统的user role permission权限赋予结构修改为user role task permission权限赋予结构,建立了基于任务和角色的访问控制模型,给出了其形式化定义。该模型解决了传统的基于角色访问控制中的动态适应性差和最小权限约束假象的问题,用于分布式工作流管理系统,提高了安全性、实用性。
