Method for improving dRBAC model based on trust mechanism
A model and mechanism technology, applied in the field of information security, which can solve the problems of implicit promotion of roles, failure to consider the trust of two entities, and lack of control over the depth of third-party delegation to achieve the effect of facilitating in-depth control.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0082] In this embodiment, the improved model is applied to deep control of entrustment.
[0083] The original dRBAC model does not have enough control over delegation. If an entity has the right to assign a role, he can not only delegate the access right of the role, but also delegate the right to assign. In this case It is very insecure, and will cause the length of the certificate chain to be uncontrollable, increasing the complexity of certificate search.
[0084] In order to solve the above problems, it is necessary to control the depth of delegation, and by introducing trust degree in the delegation process, the depth can be flexibly controlled.
[0085] In role delegation, entity A stipulates that the trust threshold A.a.Trustline of role A.a in its name space is 75, and A's trust degree to B and C in A's trust table is 90 and 80 respectively. Then A can delegate A.a to entities B and C through object delegation or assignment delegation.
[0086] The assigned commissi...
Embodiment 2
[0097] This embodiment is to apply the improved model to cascade revocation of role authorization.
[0098] After the authorization tree is established, the entity can define authorization tree update rules, and check and update the authorization tree at intervals or every N operations. If the trust degree of a node drops below the role trust degree threshold of the authorization source, the node will be cut out from the authorization tree. Whether the node's child nodes are cut out together depends on the specific access control entry.
[0099]The revocation of authorization in the original dRBAC model is very inefficient. When an entity wants to take back the access rights of a certain role, he can issue a certificate to announce the cancellation of authorization for a certain entity. But when an entity wants to cancel the access permission of a certain entity, it is more difficult to cancel the access permission of all entities assigned by the entity. For example, for rol...
Embodiment 3
[0103] In this embodiment, the improved model is applied to determine whether there is an implicit promotion of role authority after the delegation is completed.
[0104] The original dRBAC model provides a distributed access control and authorization management model in a multi-domain dynamic alliance environment, but each individual domain in a multi-domain environment still uses the RBAC model to implement specific access control, and the principle of least privilege is One of the three basic principles of the RBAC model, when there is a violation of the principle of least privilege, it will bring serious security risks. Without the knowledge of the security administrator, a role may obtain the privileges of a role with a higher level than him. permission. Because the dRBAC model is a distributed model aimed at multi-domain environments, there is no unified security management mechanism, and it is impossible to perform centralized management to prevent potential safety haza...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More