A new role hierarchy model for RBAC (role-based access control) is presented and its features are illustrated through examples. Some new concepts such as private permission, public permission and special permission ar...A new role hierarchy model for RBAC (role-based access control) is presented and its features are illustrated through examples. Some new concepts such as private permission, public permission and special permission are introduced, based on the RRA97 model. Some new role-role inheriting forms such as normal inheritance, private inheritance, public inheritance and special-without inheritance are defined. Based on the ideas mentioned, the new role hierarchy model is formulated. It is easier and more comprehensible to describe role-role relationships through the new model than through the traditional ones. The new model is closer to the real world and its mechanism is more powerful. Particularly it is more suitable when used in large-scale role hierarchies.展开更多
The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- thoug...The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- though a number of policy integration and sec- urity analysis mechanisms have been devel- oped, few focus on enabling the average ad- ministrator by providing an intuitive cognitive sense about the integrated policies, which considerably undermines the usability factor. In this paper we propose a visualization flame- work for inter-domain access control policy integration, which integrates Role Based Ac- cess Control （RBAC） policies on the basis of role-mapping and then visualizes the inte- grated result. The role mapping algorithm in the framework considers the hybrid role hier- archy. It can not only satisfy the security con- straints of non-cyclic inheritance and separa- tion of duty but also make visualization easier. The framework uses role-permission trees and semantic substrates to visualize the integrated policies. Through the interactive policy query visualization, the average administrator can gain an intuitive understanding of the policy integration result.展开更多
针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Per...针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Permission Mapping Mechanism),该模型基于向量化与度量化算子的复合运算,提出了度量角色的概念,并以其为授权粒度对委托约束机制进行讨论,增强了权限传播的可控性.最后,通过三个典型的支持细粒度委托的模型在映射机制下的具体实现,验证了RDBMPM模型的研究意义.展开更多
文摘A new role hierarchy model for RBAC (role-based access control) is presented and its features are illustrated through examples. Some new concepts such as private permission, public permission and special permission are introduced, based on the RRA97 model. Some new role-role inheriting forms such as normal inheritance, private inheritance, public inheritance and special-without inheritance are defined. Based on the ideas mentioned, the new role hierarchy model is formulated. It is easier and more comprehensible to describe role-role relationships through the new model than through the traditional ones. The new model is closer to the real world and its mechanism is more powerful. Particularly it is more suitable when used in large-scale role hierarchies.
基金supported in part by National Key Basic Research Program of China (973 Program) under Grant No.2013CB329603National Natural Science Foundation of China under Grant No.60903191
文摘The rapid increase in resource sharing across domains in the cloud comput- ing environment makes the task of managing inter-domain access control policy integration difficult for the security administrators. Al- though a number of policy integration and sec- urity analysis mechanisms have been devel- oped, few focus on enabling the average ad- ministrator by providing an intuitive cognitive sense about the integrated policies, which considerably undermines the usability factor. In this paper we propose a visualization flame- work for inter-domain access control policy integration, which integrates Role Based Ac- cess Control （RBAC） policies on the basis of role-mapping and then visualizes the inte- grated result. The role mapping algorithm in the framework considers the hybrid role hier- archy. It can not only satisfy the security con- straints of non-cyclic inheritance and separa- tion of duty but also make visualization easier. The framework uses role-permission trees and semantic substrates to visualize the integrated policies. Through the interactive policy query visualization, the average administrator can gain an intuitive understanding of the policy integration result.
文摘针对现有RBAC(Role-Based Access Control)委托授权模型存在的不足:其一,没有有效地实现细致委托粒度;其二,权限传播没有得到很好的控制,给出一种基于映射机制的细粒度角色委托模型RDBMPM(Fine-Grained Role Delegation Model Based Permission Mapping Mechanism),该模型基于向量化与度量化算子的复合运算,提出了度量角色的概念,并以其为授权粒度对委托约束机制进行讨论,增强了权限传播的可控性.最后,通过三个典型的支持细粒度委托的模型在映射机制下的具体实现,验证了RDBMPM模型的研究意义.
