应用角色访问控制的工作流动态授权模型

形式化地描述了角色、用户、权限、任务单元、授权策略、授权约束等实体及其相互间的关系，提出将授权约束分为需求角色约束、需求用户约束、拒绝角色约束及拒绝用户约束，并在此基础上建立了授权约束的冲突检测规则．实现了授权流与工作流的同步，并通过授权约束的冲突检测确保了工作流的有效执行．文中模型具有全面性与实用性较强的特点．     

A model for evaluation and administration of security inobject-oriented databases

The integration of object-oriented programming concepts with databases is one of the most significant advances in the evolution of database systems. Many aspects of such a combination have been studied, but there are few models to provide security for this richly structured information. We develop an authorization model for object-oriented databases. This model consists of a set of policies, a structure for authorization rules, and algorithms to evaluate access requests against the authorization rules. User access policies are based on the concept of inherited authorization applied along the class structure hierarchy. We propose also a set of administrative policies that allow the control of user access and its decentralization. Finally, we study the effect of class structuring changes on authorization     

支持动态授权的网格授权机制

针对网格环境下动态授权需求,提出一种支持动态授权的网格授权机制。在对授权策略进行分类并形式化描述的基础上,定义了支持静、动态授权的授权规则。该规则支持组件级、功能级和参数级3种粒度的授权,可满足不同粒度授权的需求并提供协商授权功能。设计了基于静、动态授权规则和授权转换规则的策略匹配算法,并结合该算法给出了可支持静、动态授权的应用实例,应用结果表明了授权机制的可行性和有效性。     

基于平台可信等级的RBAC模型研究与改进

针对RBAC模型仅仅依靠用户身份进行角色和权限分配,未考虑用户平台的安全及可信性的问题,提出一种基于平台可信等级的改进RBAC模型(TLPRBAC)。TLPRBAC模型引入可信平台和可信等级两个实体元素,改进了实体关系和授权规则。改进的RBAC模型采用将角色与可信等级、可信等级与访问客体相关联的方法,实现不同可信等级主体对不同安全级别客体的细粒度访问控制。最后提出一个TLPRBAC模型在政府内网中的文件访问控制应用方案。     

文档管理系统中小粒度授权机制的研究

提出了操作权限分类的方法和标准,结合文档管理的业务特点,进行了基于文档结构树的授权业务建模;为求解权限管理的基本问题公式,建立了资源可拓展的、分级授权的授权机制,定义了授权机制的粗规则和业务逻辑接口,实现了树型资源等复杂资源系统的权限分配方式。     

应用区域边界授权模型

应用区域边界安全系统是一个关防系统,它在使用过程中能否达到保护应用环境安全的目标是由其安全授权规则集的完备性和一致性及对其授权的简便性决定的。应用环境中的主体是通过各种不同的应用协议对客体进行访问的,它们在通过应用区域边界安全系统时,应用区域边界安全系统将根据安全授权规则集对其访问请求进行检验,若满足安全授权规则集要求,则允许通过,反之拒绝。因此,我们根据访问请求所涉及的主体、客体、协议、安全策略等部件,给出了应用区域边界授权的体系结构,同时在给出刻画它们特性的谓词基础上,提出了易于表达安全策略的应用区域边界形式化授权模型。对此形式化模型进行编译不仅可以根据安全策略对授权的合法性进行检验,而且也可以及时发现安全策略中存在的漏洞,从而可以得到一个正确的安全授权规则集。     

复杂资源的小粒度分级授权机制的研究

分析了授权操作的运算规律,定义了授权算子集及其运算规则,提出了小粒度分级授权机制的三层架构;同时,基于定义的算子,对操作权限进行了分类,定义了小粒度分级授权模型的固有规则,建立了实际操作和算子组合之间的映射模型,完成了授权业务操作的同步,建立了资源可拓、分级授权的小粒度授权模型,实现了复杂资源的小粒度分级授权。最后以产品文档管理系统的小粒度授权模块为实例,证明了研究内容的有效性。     

Role-based authorizations for workflow systems in support of task-based separation of duty

Role-based authorizations for assigning tasks of workflows to roles/users are crucial to security management in workflow management systems. The authorizations must enforce separation of duty (SoD) constraints to prevent fraud and errors. This work analyzes and defines several duty-conflict relationships among tasks, and designs authorization rules to enforce SoD constraints based on the analysis. A novel authorization model that incorporates authorization rules is then proposed to support the planning of assigning tasks to roles/users, and the run-time activation of tasks. Different from existing work, the proposed authorization model considers the AND/XOR split structures of workflows and execution dependency among tasks to enforce separation of duties in assigning tasks to roles/users. A prototype system is developed to realize the effectiveness of the proposed authorization model.     

ERBAC模型的改进与实现*

阐述了RBAC96模型在实际应用中存在授权、访问规则、细粒度访问控制等方面的不足,分析了基于角色对用户和角色混合授权的ERBAC模型的不足,提出了一种改进ERBAC模型,使其授权更加灵活,安全性更高,并采用引入访问规则和模糊时间约束机制以及把系统模块和角色进行绑定的方法予以实现。访问规则和审计功能及模糊时间约束机制的引入能使安全性更高,把系统模块和角色进行绑定达到细粒度的访问控制。改进ERBAC模型的授权更加灵活,其安全性更高。     

工作流系统带权角色与周期时间访问控制模型

带权角色激活任务和周期时间授权是工作流系统访问控制研究尚未解决的核心问题.以基于角色的访问控制模型为基础,提出了一种新的工作流系统带权角色与周期时间访问控制模型WRPTAC(weighted role and periodic time access control).讨论了周期时间表示方法,定义了工作流系统授权新概念和时态授权推导规则,给出了时间复杂度为O(n²)的时态授权推导规则一致性验证图论算法,并定义了任务激活约束规则.它能够表达复杂的工作流系统访问控制约束.     

基于知识发现的风险最小化授权模型

访问控制技术是网络信息系统安全的核心技术之一。针对开放式网络下基于信任访问控制问题中的授权需求,提出了基于知识发现的风险最小化授权(信任-权限)模型,对模型元素、关系、约束和规则、授权策略进行了形式化定义。RMAM-KD模型引入信任和风险的概念,对权限进行细粒度划分,将交互中涉及到的实体属性及其信任值和风险值作为授权判断的重要参考依据,并加入时间约束限制,能够更好地支持动态的授权机制。最后,给出了RMAM-KD模型授权的应用实例及安全性分析,表明RMAM-KD模型能够有效地保证对客体资源的安全访问。     

PBAC: Provision-based access control model

Over the years a wide variety of access control models and policies have been proposed, and almost all the models have assumed “grant the access request or deny it.” They do not provide any mechanism that enables us to bind authorization rules with required operations such as logging and encryption. We propose the notion of a “provisional action” that tells the user that his request will be authorized provided he (and/or the system) takes certain actions. The major advantage of our approach is that arbitrary actions such as cryptographic operations can all coexist in the access control policy rules. We define a fundamental authorization mechanism and then formalize a provision-based access control model. We also present algorithms and describe their algorithmic complexity. Finally, we illustrate how provisional access control policy rules can be specified effectively in practical usage scenarios. Published online: 22 January 2002     

Mapping Considerations in the Design of Schemas for the Relational Model

The typical design process for the relational database model develops the conceptual schema and each of the external schemas separately and independently from each other. This paper proposes a new design methodology that constructs the conceptual schema in such a way that overlappings among external schemas are reflected. If the overlappings of external schemas do not produce transitivity at the conceptual level, then with our design method, the relations in the external schemas can be realized as a join over independent components. Thus, a one-to-one function can be defined for the mapping between tuples in the external schemas to tuples in the conceptual schema. If transitivity is produced, then we show that no such function is possible and a new technique is introduced to handle this special case.     

支持授权的基于角色的访问控制模型及实现

现有的基于角色的访问控制模型多采用集中授权管理方式，不能满足大型复杂协作系统的需求．文中对RBAC96模型进行扩展，形成了支持授权的基于角色的访问控制模型．该模型引入角色语境作为自主授权活动的依据，通过语境部件授权极限值、授权域、授权类型以及撤销类型的定义，以支持灵活的自主授权活动，并支持多步授权，允许安全管理员对系统进行宏观安全控制．对该模型的基本部件和规范进行了描述，并且给出授权活动的实现算法和应用实例．     

基于任务的授权模型

商业信息系统与军事信息系统的不同，使得传统的基于主体、客体观点的访问控制技术不再适合于多点访问控制的信息处理。针对一种新的授权策略-基于任务的授权策略，给出了一种形式化描述，用集合和关系的概念定义了该模型的基本性质、规则、操作。最后对其安全性进行了分析。在该模型中，授权并不是简单地体现在静态的（s,o,a）三元组中，而是有生命周期的，并伴随着任务实例的执行而改变状态。它能使授权、跟踪资源的使用、收回许可等自动执行，以协调各种不同任务的进展。     

面向多级关系数据库的RBAC扩展模型

提出了一种角色访问控制扩展模型,该模型在标准RBAC体系中引入分级策略,通过扩展读写规则和授权限制消除了RBAC中向下的信息流,并通过范围分离和会话密级等语义保留了标准RBAC的灵活性和表达力。该模型可应用在众多既需要控制信息流动的强制存取控制又需要有角色存取机制灵活性的系统中。在给出模型的形式化定义后,对模型的实现规则、访问策略、权限分配管理、在多级关系数据库中的实现机制及模型的BNF范式以及具体应用做了说明。     

Authorization Translation for XML Document Transformation

XML access control models proposed in the literature enforce access restrictions directly on the structure and content of an XML document. Therefore access authorization rules (authorizations, for short), which specify access rights of users on information within an XML document, must be revised if they do not match with changed structure of the XML document. In this paper, we present two authorization translation problems. The first is a problem of translating instance-level authorizations for an XML document. The second is a problem of translating schema-level authorizations for a collection of XML documents conforming to a DTD. For the first problem, we propose an algorithm that translates instance-level authorizations of a source XML document into those for a transformed XML document by using instance-tree mapping from the transformed document instance to the source document instance. For the second problem, we propose an algorithm that translates value-independent schema-level authorizations of non-recursive source DTD into those for a non-recursive target DTD by using schema-tree mapping from the target DTD to the source DTD. The goal of authorization translation is to preserve authorization equivalence at instance node level of the source document. The XML access control models use path expressions of XPath to locate data in XML documents. We define property of the path expressions (called node-reducible path expressions) that we can transform schema-level authorizations of value-independent type by schema-tree mapping. To compute authorizations on instances of schema elements of the target DTD, we need to identify the schema elements whose instances are located by a node-reducible path expression of a value-independent schema-level authorization. We give an algorithm that carries out path fragment containment test to identify the schema elements whose instances are located by a node-reducible path expression.     

Secure context-sensitive authorization

There is a recent trend toward rule-based authorization systems to achieve flexible security policies. Also, new sensing technologies in pervasive computing make it possible to define context-sensitive rules, such as “allow database access only to staff who are currently located in the main office”. However, these rules, or the facts that are needed to verify authority, often involve sensitive context information. This paper presents a secure context-sensitive authorization system that protects confidential information in facts or rules. Furthermore, our system allows multiple hosts in a distributed environment to perform the evaluation of an authorization query in a collaborative way; we do not need a universally trusted central host that maintains all the context information. The core of our approach is to decompose a proof for making an authorization decision into a set of sub-proofs produced on multiple different hosts, while preserving the integrity and confidentiality policies of the mutually untrusted principals operating these hosts. We prove the correctness of our algorithm.     

面向社交网络的多方授权模型

现有的访问控制机制大多局限在用户个人空间内的数据,难以控制个人空间以外的数据,例如用户不能对其在朋友空间中发布的评论进行访问控制,不能对共有的资源进行联合访问控制等。面向社交网络的多方授权模型MRuleSN采用单一所有、多方共有的方法处理所有权问题,采用扩展的w-Datalog规则表达授权,具有更强的灵活性、访问细粒度和表达能力。分析并说明了模型的规则结构、授权语言的语法和语义,最后通过示例说明了该模型的应用和表达能力。