一种层次信任的多粒度RBAC扩展模型

针对企业级网络应用集成环境中授权和访问控制要求,提出一种以信任角色授权的分层和多粒度的访问控制扩展模型(EmRBAC),结合NIST-RBAC的标准模型,利用可信凭证扩展用户和角色之间的层次,增加角色的信任层次,并从系统、应用、操作对象的功能和级别、操作数据的时间周期等多个维度对标准模型进行了访问权限的粒度细化,加强访问权限的多粒度控制,并通过角色状态分层预处理,降低权限判别时的复杂性,提高访问控制效率。最后以开源门户eXo Platform为实验平台,给出了模型的访问控制流程以及应用实例,以验证提出模型的有效性。

An expanded RBAC model of multi-granularity based on trust hierarchies

Based on the application integration environment for enterprise network authorization and access control requirements, a trust role authorization by stratified and multi-granular access control extension model (EmRBAC) is proposed, which is combined with NIST RBAC standard model, use the trusted credentials extension level between users and roles, and increase the role of trust level. From the system, applications, functions and operation of the object level, operating data time period and many other dimensions of the standard model, the elaboration of granularity of access rights is carried out. Through the role of the state stratification pretreatment reduced privileges determine the complexity and increase the efficiency of access control. Final, as an open source portal exobiology platform for experimentation platform, the model of access control processes and application examples are obtained to verify the effectiveness of the proposed model.