基于角色的域-类型增强访问控制模型研究及其实现

Research and Implementation of Role-Based Domain and Type Enforcement Access Control Model

安全系统只有能够支持多种安全政策才能满足实际需求 .基于角色的访问控制 (Role BasedAccessCon trol,RBAC)是一种政策中性 (PolicyNeutral)的新模型 ,已经实现了多种安全政策 .域 类型增强 (DomainandTypeEnforce ment,DTE)安全政策充分体现了最小特权 (LeastPrivilege)和职责分离 (SeparationofDuty)的安全原则 ,但是 ,RBAC96不便于直接实现DTE .根据RBAC和DTE的思想 ,本文提出了“基于角色的域 类型增强访问控制”(Role BasedDomainandTypeEnforcementAccessControl,RDTEAC)模型 .该模型继承了RBAC96的优点 ,又体现了DTE的安全思想 ,并易于实现DTE安全政策 .此外 ,我们还在Linux上实现了RDTEAC模型的一个原型 .

Only those systems which support multiple security policies can meet practical security requirements. The role-based access control (RBAC) is a new policy-neutral model, which has enforced multiple security policies. The domain and type enforcement security policy fully reflects the security principles of least privilege and separation of duties. According to RBAC and DTE, the role-based domain and type enforcement access control (RDTEAC) model is presented. RDTEAC not only inherits the advantage of RBAC, but also facilitates implementation of DTE security policy. A Linux prototype of RDTEAC was developed.