Multidimension object access control method based on roles

Abstract

A conception of object dimension is introduced into the area, where the administrated objects (AO) are rather concentrative. The definition of AO is finely compartmentalized. The AO are compartmentalized into manifold groups under different dimensions. Nesting between groups is allowed. A multi-layer tree is formed. The different dimension represents different sorting modes of AO. The system supports several sorting modes co-existed. The system authorities are split into data authority and operate authority. For the data authority, all data entity in this system controlled by the data authority must possess corresponding safety administration objects (SAO). Associating these SAO with different Role, the invention can complete the data authorities splitting. All SAO in this model are grouped. Multi-grouping all SAO in the system in the same running are supported. Each grouping model is named a 'dimension'. Each value on the dimension is corresponding to a certain group.

Description

technical field [0001] The invention relates to a security solution for a computer database, in particular to an access control method for the database. Background technique [0002] Access Control: or Authorization. Access control is one of many computer security solutions, and it is the most intuitive and natural one. The risk of information security can be broadly attributed to CIA: information confidentiality (Confidentiality), information integrity (Integrity) and information availability (Availability). Access control mainly provides protection for information confidentiality and information integrity. Specifically, the software system provides the following controls: allowing authorized subjects to access certain objects; refusing to provide services to unauthorized subjects. [0003] RBAC (Role Based Access Control): Role-based access control model. There are many mainstream implementation models for access control, including discretio...

AI Technical Summary

Problems solved by technology

[0020] In the Core RBAC model, if the system implements fine-grained permission control, as the size of the object of access control—the managed object grows, the number of PA (allowing to specify Permission Assignment) associations will expand rapidly, which will bring complexity to the authorization work sex

In addition, the organic connection between the managed objects is not defined in the model, which cannot reflect the macroscopic structure of the software system, and is not conducive to the introduction of management strategies at different levels

Images