APDM : 속성을 추가한 권한위임 모델
APDM : Adding Attributes to Permission-Based Delegation Model
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
위임은 사용자에게 접근 권한을 사상(mapping)하여 유연하고 동적인 접근제어 결정을 제공하는강력한 메카니즘이다. 또한, 분산환경에 유용하다. 대표적인 위임 모델 중 RBDM0 와 RDM200은사용자 대 사용자 위임으로서 역할위임이다. 그러나, RBAC에서 역할계층의 상속 개념은 실 기업조직의 관리 규칙과 조화롭지 못하다. 본 논문에서 우리는 위임 권한의 영속성을 보장하고 의무분리 원칙과 최소 권한의 보안 원칙에 위배되지 않는 속성을 첨가한 권한위임 모델 (APDM)을 제안한다. RBAC모델을 기반으로 하는 APDM은 속성을 사용하여 역할 대 역할과 사용자 대 사용자의 위임을 제공한다. 위임자는 원하는 권한만을 특정인에게 위임할 수 있고, 속성을 활용하여 위임자가 원하는 시점에서 권한을 회수할 수 있다.
Abstract
Delegation is a powerful mechanism that allocates access rights to users to provide flexible and dynamic access control decisions. It is also particularly useful in a distributed environment. Among the representative delegation models, the RBDM0 and RDM2000 models are role delegation as the user to user delegation. However, In RBAC, the concept of inheritance of the role class is not well harmonized with the management rules of the actual corporate organization. In this paper, we propose an Adding Attributes on Permission-Based Delegation Model (ABDM) that guarantees the permanence of delegated permissions. It does not violate the separation of duty and security principle of least privilege. ABDM based on RBAC model, supports both the role to role and user to user delegation with an attribute. whenever the delegator wants the permission can be withdrawn, and A delegator can give permission to a delegatee.
참고문헌 (15)
- Ravi S Sandhu, "Role-based Access Control Model", IEEE, pp.38~47 (1996)
- Ezedin Barka, "Framework for Role-based Delegation Model and Some Extensions", Proceedings of the 23rd NIST-NCSC National Information Systems Security Conference, pp.101~114 (2000)
- "Role Usage and Activation Hierarchies" (2005)[URL]
- Zhang L, "A Rule-based Framework for Role-based Delegation Revocation", ACM Transactions on Information and System Security, 6(3), pp.404~441 (2003)
- Crampton, J., "Delegation in Role-Based Access Control", Proc. 11th European Symposium On Research In Computer Security (ESORICS 2006) (2006)
- A Ali, "Taxonomy of delegation model", 12th international conference on information technology-new generations, pp.218~223 (2015), IEEE
- XinWen Zhang, "PBDM: A Flexible Delegation Model in RBAC", 8th ACMSympo siumon Access Control Models and Technologies (SACMAT-03), pp.149~157 (2003)
- Jun Zheng, , Applied Informatics and Communication, 227, pp.526~ (2011)
- Tahmina Ahmed, "Classifying and Comparing Attribute-Based and Relationship-Based Access Control", Conference: the Seventh ACM (2017)
- X. Jin, "A unied attribute-based access control model covering DAC,MAC and RBAC", IFIP Annual Conference on Data and Applications Security and Privacy, pp.41~55 (2012), Springer
- Chunxiao Ye, "An attribute-Based-Delegation-Model", ACM International Conference Proceeding Series,Vol85, Proceedings of the 3rd international Conference in Information security, pp.220~221 (2004)
- Jiwan Ninglekhu, "AARBAC: Attribute-Based Administration of Role-Based Access Control", 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC) (2017), IEEE
- Koji Hasebe, "Capabilitybased delegation model in RBAC", Proceedings of the 15th ACM symposium on Access control models and technologies, pp.109~118 (2010)
- D. R. Kuhn, "Adding attributes to role-based access control", Computer, 6, pp.79~81 (2010)
- Bernhard J. Berger, "Towards Effective Verification of Multi-Model Access Control Properties", Proceedings of the 24th ACM Symposium on Access Control Models and Technologies, pp.149~160 (2019)