Role-based access control for substation automation systems using XACML

There has been an increasing need for accessing data of internal equipment and devices of a substation system from external systems as power grids evolve. This has also introduced growing concerns on data security. In response to the concerns, IEC 62351 has proposed role-based access control (RBAC) for substation automation. In this work, we present a novel approach for implementing RBAC based on IEC 62351 for substation automation using eXtensible Access Control Markup Language (XACML). We integrate the approach with IEC 61850 by extending Abstract Communication Service Interface (ACSI), Manufacturing Message Specification (MMS), and System Configuration Language (SCL). A major advantage of the approach is that it fully conforms to both IEC 61850 and IEC 62351 and highly compatible with SCL as both XACML and SCL are XML-based. We implement the approach using OpenIEC61850 which is an open source library for ACSI services and demonstrate the implementation.     

网格访问控制与授权模型的设计与实现

访问控制和资源授权是网格系统中资源与用户的关系策略的集合,分析了访问控制与资源授权的设计原则,提出了一种基于禁止表和允许表的网格用户访问控制层次式AB4L访问控制模型.给出了该模型的形式化定义,叙述了基于Postgres数据库的资源访问控制模型和授权的实现方法,并从完备性、可扩展性、自主控制和安全性方面对该模型进行了性...     

Role-based access control models

Security administration of large systems is complex, but it can be simplified by a role-based access control approach. This article explains why RBAC is receiving renewed attention as a method of security administration and review, describes a framework of four reference models developed to better understand RBAC and categorizes different implementations, and discusses the use of RBAC to manage itself     

Role-based access control in DCOM

The explosive growth of the Web, the increasing popularity of PCs and the advances in high-speed network access have brought distributed computing into the mainstream. To simplify network programming and to realize component-based software architecture, distributed object models have emerged as standards. One of those models is distributed component object model (DCOM) which is a protocol that enables software components to communicate directly over a network in a reliable, and efficient manner. In this paper, we investigate an aspect of DCOM concerning software architecture and security mechanism. Also, we describe the concept of role-based access control (RBAC) which began with multi-user and multi-application on-line systems pioneered in the 1970s. And we investigate how we can enforce the role-based access control as a security provider within DCOM, specially in access security policy.     

基于角色的对OWL本体的访问控制模型

本体是对共享概念明确的形式化规范说明,是语义Web实现的关键技术。当前语义Web缺乏对本体有效的访问控制手段,因此本体的发布必然会导致相关领域敏感信息的泄露。提出了一个基于角色的OWL本体访问控制模型,该模型充分利用了本体元素之间的语义关联性,对传统的RBAC模型进行了扩展,能够对OWL本体以及本体元素的访问实施有效地控制,同时也解决了OWL本体访问控制中推理泄露的问题。     

一种分布式环境下基于角色的访问控制模型

针对访问控制模型在分布式系统下的局限性,提出一种分布式系统下的基于角色的访问控制模型。该模型以传统RBAC为基础,对其进行了扩展,一方面通过将角色扩展为职能角色和任务角色,另一方面为任务角色增加一个属性,用以标识该角色所赋予的主体属于本域还是外域,避免了采用对等角色直接进行角色分配的简单化处理。从而一方面有利于最小权限的实现,另一方面实现了对本域和外域的主体访问请求采用不同的策略,使基于角色的控制应用范围从集中式的控制领域扩展到分布式的控制领域,以适应不断发展的分布式环境系统的需求。     

Role-based access control for a Grid system using OGSA-DAI and Shibboleth

In this paper, we propose a new role-based access control (RBAC) system for Grid data resources in the Open Grid Services Architecture Data Access and Integration (OGSA-DAI). OGSA-DAI is a widely used framework for integrating data resources in Grids. However, OGSA-DAI’s identity-based access control causes substantial administration overhead for the resource providers in virtual organizations (VOs) because of the direct mapping between individual Grid users and the privileges on the resources. To solve this problem, we used the Shibboleth, an attribute authorization service, to support RBAC within the OGSA-DAI. In addition, access control policies need to be specified and managed across multiple VOs. For the specification of access control policies, we used the Core and Hierarchical RBAC profile of the eXtensible Access Control Markup Language (XACML); and for distributed administration of those policies and the user-role assignments, we used the Object, Metadata and Artifacts Registry (OMAR). OMAR is based on the e-business eXtensible Markup Language (ebXML) registry specifications developed to achieve interoperable registries and repositories. Our RBAC system provides scalable and fine-grain access control and allows privacy protection. It also supports dynamic delegation of rights and user-role assignments, and reduces the administration overheads for the resource providers because they need to maintain only the mapping information from VO roles to local database roles. Moreover, unnecessary mapping and connections can be avoided by denying invalid requests at the VO level. Performance analysis shows that our RBAC system adds only a small overhead to the existing security infrastructure of OGSA-DAI.     

面向服务网格的访问控制模型研究*

建立以网格服务为中心的访问控制模型,通过集中式的管理来降低网格环境中访问控制复杂性,将角色网格服务的分配和服务的访问授权分离管理,能够有效地保护资源拥有者的权限。在中国科学院escience科学数据网格项目中的初步应用实施表明了该模型的灵活性和有效性。     

基于角色的Web Services动态访问控制模型

已有模型对Web Services的访问控制多数是静态的、粗粒度的,不能满足动态的面向服务的Web Services环境。为此提出了一个基于角色的Web Services动态访问控制模型(RBDAC),此模型可以根据用户访问时的上下文信息来激活角色分配和权限分配,并动态地做出访问控制决定。     

基于角色的访问控制模型及其面向对象的建模

访问控制是信息安全的一个研究方向,基于角色的访问控制(RBAC)是目前理论研究和应用研究比较广泛的一种模型。详细介绍了RBAC96模型家族的特征和它所遵循的安全准则,并引入面向对象的思想,采用统一建模语言(UML)对RBAC96进行了静态和动态建模,这样就缩短了理论模型和实际系统开发之间的差距,有助于信息系统安全的面向对象的分析与设计。     

电子现金系统的RBAC管理方案

在基于电子现金的网络支付方案中,交易过程相关的多个实体有不同类型的权限和访问标准,如果各自进行安全管理,会使得整个系统的维护协调有很大难度。因此,横跨多个实体的权限管理带来了额外的安全性挑战。分析了基于RBAC的电子现金系统的权限管理策略,通过基于常规角色的授权实现了对电子现金系统内多个实体的访问控制,并设置与常规角色互斥的管理角色实现系统的分布式自行管理．     

具有时空约束的角色访问控制模型

信息技术的高度发展对信息安全提出了新的挑战,经典的基于角色的访问控制（RBAC）中缺乏对时间和空间的约束,使RBAC模型不能适应信息系统新的安全需求。在RBAC的基础上,引入了时空域的定义,对模型中各要素进行了时间和空间约束,提出了具有时空约束的角色访问控制模型（TSRBAC）。形式化地描述了TSRBAC,并定义了时空角色继承和时空职责分离,给出了时空访问控制算法。     

基于属性的授权和访问控制研究

因开放环境的分布性、异构性和动态性，对访问控制提出了独特的安全挑战。基于属性的访问控制（ABAC）机制比基于身份的访问控制机制更能解决管理规模和系统灵活性问题，并提供细粒度的控制，已证明了对这种环境的适应性。讨论了ABAC的授权和访问控制机制、实现框架、属性管理等问题，并通过对关键技术的比较分析，提出了将来需要研究的内容，为该领域的进一步研究提供了思路。     

网格服务中基于XACML和SAML的安全访问控制

为了解决网格环境下资源访问控制存在的安全性问题,通过分析可扩展访问标记语言XACML、安全声明标记语言SAML及其相关技术,提出了一个基于XACML和SAML的访问控制模型。模型采用可扩展访问标记语言XACML描述访问控制的授权策略,以SAML声明为载体传递用户认证和授权信息,提供安全、细粒度的访问控制,具有较高的灵活性和可扩展性。     

基于XACML的网格授权服务的设计与实现

为更好地解决网格环境下分布式跨域授权问题、增强授权功能的可扩展性和可复用性,构建了基于可扩展访问控制标记语言(extensible access control markup language,XACML)规范的网格授权框架.在该框架的基础上,依照Web服务资源框架和Web服务通知规范,设计实现了基于XACML策略引擎的网格授权服务.将复杂的模块交互调用封装在授权框架内,通过简单易用的服务接口实现域间互操作时的权限分配.实现结果表明,该框架更加灵活,适用于动态、异构的网格环境.     

.应用角色和任务访问控制的工作流动态授权模型

为实现职责分离和最小权限约束,在传统基于角色和任务访问控制模型的基础上,提出一种应用角色和任务访问控制的工作流动态授权模型。该模型主要包含：①引入了工作流上下文信息来加强职责分离约束;②把权限最小化到任务状态层次;③根据工作流的变化和执行任务所处的状态进行动态地授权。最后以驾驶员培训系统为例,说明了该模型怎样动态实现最小权限约束、职责分离和动态授权,以此说明该模型能够满足工作流动态变化频繁的复杂系统访问控制的需要。     

复合模式的网格系统信任授权模型

作为研究焦点的网格系统提供了一种受控的跨边界的资源共享的虚拟框架。对网格环境进行了分析,讨论了网格对信任管理的需求。在分析各种信任模型不足的基础上,基于网格具体的应用环境,并结合以PGP用户为中心的信任模型和SPKI授权证书机制各自的优势,提出了复合模式的网格信任授权模型,并完整设计了整个模型的可实现框架。     

基于RBAC策略的可信网格访问控制模型*

针对网格环境的特点,分析了网格中实体间的信任关系,给出了信任度的计算方法。对RBAC技术进行了相应的改进,提出了基于RBAC的可信网格访问控制模型,给出了RTGM模型中的结构和模块以及访问控制部分的过程。可信网格访问控制提高了网格环境下的访问安全性。     

Role-based access control with X.509 attribute certificates

We adapted the standard X.509 privilege management infrastructure to build an efficient role-based trust management system in which role assignments can be widely distributed among organizations, and an XML-based local policy determines which roles to trust and which privileges to grant. A simple Java API lets target applications easily incorporate the system. The Permis API has already proven its general utility in four very different applications throughout Europe.     

Enhancing grid security by fine-grained behavioral control and negotiation-based authorization

Nowadays, Grid has become a leading technology in distributed computing. Grid poses a seamless sharing of heterogeneous computational resources belonging to different domains and conducts efficient collaborations between Grid users. The core Grid functionality defines computational services which allocate computational resources and execute applications submitted by Grid users. The vast models of collaborations and openness of Grid system require a secure, scalable, flexible and expressive authorization model to protect these computational services and Grid resources. Most of the existing authorization models for Grid have granularity to manage access to service invocations while behavioral monitoring of applications executed by these services remains a responsibility of a resource provider. The resource provider executes an application under a local account, and acknowledges all permissions granted to this account to the application. Such approach poses serious security threats to breach system functionality since applications submitted by users could be malicious. We propose a flexible and expressive policy-driven credential-based authorization system to protect Grid computational services against a malicious behavior of applications submitted for the execution. We split an authorization process into two levels: a coarse-grained level that manages access to a computational service; and a fine-grained level that monitors the behavior of applications executed by the computational service. Our framework guarantees that users authorized on a coarse-grained level behave as expected on the fine-grained level. Credentials obtained on the coarse-grained level reflect on fine-grained access decisions. The framework defines trust negotiations on coarse-grained level to overcome scalability problem, and preserves privacy of credentials and security policies of, both, Grid users and providers. Our authorization system was implemented to control access to the Globus Computational GRAM service. A comprehensive performance evaluation shows the practical scope of the proposed system.