面向服务的多租户访问控制模型研究

传统访问控制模型在多租户环境下无法满足租户之间的隔离访问以及对各租户的访问请求实行有效的统一管理的需求。为了在多租户环境下实现一套快速的、访问控制可配置的实施方案, 提出了一个面向服务的多租户访问控制模型。根据对多视图业务模型之间的关联进行分析, 识别出组织模型及其相关的资源模型。通过映射和转换将组织模型转换为面向服务的多租户访问控制模型, 并构建访问控制模块以配置和运行访问控制模型。最后以某交通物流信息平台为范例验证了该模型的可行性和有效性。验证结果表明, 模型能够在多租户环境下提供兼备快速配置与访问控制的实现支持。

Research on multi-tenant service oriented access control model

In order to control accessing to system resources in isolation and to manage requests from different group of users uniformly, this paper proposed the multi-tenant service oriented access control (MSOAC) model. It firstly analyzed the relationship among elements of business model, and identified the organization model, and related resource models. After that it transformed business model into MSOAC model, and then built the access control module to configure and run the model. Lastly, it examined the feasibility and correctness of the model using transportation and logistics information platform. The result shows that the MSOAC model can properly be used to provide a simple and flexible access control solution in multi-tenant environment.