Method for improving dRBAC model based on trust mechanism
A model and mechanism technology, applied in the field of information security, can solve problems such as implicit promotion of roles, poor scalability, lack of control of third-party entrustment depth, etc., and achieve the effect of facilitating in-depth control
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0082] In this embodiment, the improved model is applied to in-depth control of commissions.
[0083] The original dRBAC model lacks in-depth control over delegation. If an entity has the right to assign a role, then it can not only delegate the access right to that role, but also delegate the right to delegate arbitrarily. In this case It is very insecure, and will cause the length of the certificate chain to be uncontrollable and increase the complexity of certificate search.
[0084] In order to solve the above problems, it is necessary to control the depth of delegation. Introducing trust in the delegation process can control the depth flexibly.
[0085] In role delegation, entity A specifies the trust level of the role A.a in its namespace, A.a.Trustline is 75, and the trust level of A in the trust level table of A is 90 and 80 for B and C, respectively. Then A can delegate A.a to entities B and C through object delegation or assignment delegation.
[0086] Assigned delegation [...
Embodiment 2
[0097] In this embodiment, the improved model is applied to role authorization cascade revocation.
[0098] After the authorization tree is established, the entity can define authorization tree update rules, and the authorization tree will be checked and updated every period of time or every N operations. If the trust degree of a node drops below the role trust degree threshold of the authorization source, the node will be cut out from the authorization tree. Whether the child nodes of this node are switched out at the same time depends on the specific access control entry.
[0099] The revocation of authorization in the original dRBAC model is very inefficient. When an entity wants to withdraw the access rights of a certain role, it can issue a certificate to announce the cancellation of the authorization of a certain entity. But when an entity wants to cancel an entity's access rights, it is more difficult to cancel the access rights of all entities assigned by the entity. For ...
Embodiment 3
[0103] In this embodiment, the improved model is applied to determine whether there is an implicit promotion of role authority after the delegation is completed.
[0104] The original dRBAC model provides a distributed access control and authorization management model in a dynamic alliance environment between multiple domains, but each individual domain in a multi-domain environment still uses the RBAC model to implement specific access control, and the principle of least privilege is One of the three basic principles of the RBAC model. When there is a violation of the principle of least privilege, it will bring serious security risks. Without the knowledge of the security administrator, a role may get a higher-level role. Permissions. Because the dRBAC model is a distributed model for a multi-domain environment, there is no unified security management mechanism, and it is impossible to conduct centralized management to prevent the appearance of security risks. Using a delegatio...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More