A General Attribute and Rule Based Role-Based Access Control Model

Growing numbers of users and many access control policies which involve many different resource attributes in service-oriented environments bring various problems in protecting resource.This paper analyzes the relationships of resource attributes to user attributes in all policies, and propose a general attribute and rule based role-based access control(GAR-RBAC) model to meet the security needs. The model can dynamically assign users to roles via rules to meet the need of growing numbers of users. These rules use different attribute expression and permission as a part of authorization constraints, and are defined by analyzing relations of resource attributes to user attributes in many access policies that are defined by the enterprise. The model is a general access control model, and can support many access control policies, and also can be used to wider application for service. The paper also describes how to use the GAR-RBAC model in Web service environments.

Permission and role automatic assigning of user in role-based access control

Role mining and setup affect the usage of role-based access control(RBAC).Traditionally,user's role and permission assigning are manipulated by security administrator of system.However,the cost is expensive and the operating process is complex.A new role analyzing method was proposed by generating mappings and using them to provide recommendation for systems.The relation among sets of permissions,roles and users was explored by generating mappings,and the relation between sets of users and attributes was analyzed by means of the concept lattice model,generating a critical mapping between the attribute and permission sets,and making the meaning of the role natural and operational.Thus,a role is determined by permission set and user's attributes.The generated mappings were used to automatically assign permissions and roles to new users.Experimental results show that the proposed algorithm is effective and efficient.

校园网中的Role-based Access Control模型设计

介绍了如何将Role basedAccessControl(RBAC)模型应用于校园网的访问控制系统中。其特点是通过分配和取消角色来完成用户权限的授予和取消 ,并且提供了角色分配规则和操作检查规则。安全管理人员根据需要定义各种角色 ,并设置合适的访问权限 ,而用户根据其责任和资历被指派为不同的角色。根据系统的实际需求 。

A Cache Considering Role-Based Access Control and Trust in Privilege Management Infrastructure

PMI （privilege management infrastructure） is used to perform access control to resource in an E-commerce or E-government system. With the ever-increasing need for secure transaction, the need for systems that offer a wide variety of QoS （quality-of-service） features is also growing. In order to improve the QoS of PMI system, a cache based on RBAC （Role-based Access control） and trust is proposed. Our system is realized based on Web service. How to design the cache based on RBAC and trust in the access control model is deseribed in detail. The algorithm to query role permission in cache and to add records in cache is dealt with. The policy to update cache is introduced also.

MTBAC： A Mutual Trust Based Access Control Model in Cloud Computing

As a new computing mode,cloud computing can provide users with virtualized and scalable web services,which faced with serious security challenges,however.Access control is one of the most important measures to ensure the security of cloud computing.But applying traditional access control model into the Cloud directly could not solve the uncertainty and vulnerability caused by the open conditions of cloud computing.In cloud computing environment,only when the security and reliability of both interaction parties are ensured,data security can be effectively guaranteed during interactions between users and the Cloud.Therefore,building a mutual trust relationship between users and cloud platform is the key to implement new kinds of access control method in cloud computing environment.Combining with Trust Management(TM),a mutual trust based access control(MTBAC) model is proposed in this paper.MTBAC model take both user's behavior trust and cloud services node's credibility into consideration.Trust relationships between users and cloud service nodes are established by mutual trust mechanism.Security problems of access control are solved by implementing MTBAC model into cloud computing environment.Simulation experiments show that MTBAC model can guarantee the interaction between users and cloud service nodes.

Security analysis of access control model in hybrid cloud based on security entropy

To resolve the problem of quantitative analysis in hybrid cloud,a quantitative analysis method,which is based on the security entropy,is proposed.Firstly,according to the information theory,the security entropy is put forward to calculate the uncertainty of the system' s determinations on the irregular access behaviors.Secondly,based on the security entropy,security theorems of hybrid cloud are defined.Finally,typical access control models are analyzed by the method,the method's practicability is validated,and security and applicability of these models are compared.Simulation results prove that the proposed method is suitable for the security quantitative analysis of the access control model and evaluation to access control capability in hybrid cloud.

The Research of Role Tree-Based Access Control Model

Towards the crossing and coupling permissions in tasks existed widely in many fields and considering the design of role view must rely on the activities of the tasks process,based on Role Based Accessing Control (RBAC) model,this paper put forward a Role Tree-Based Access Control (RTBAC) model. In addition,the model definition and its constraint formal description is also discussed in this paper. RTBAC model is able to realize the dynamic organizing,self-determination and convenience of the design of role view,and guarantee the least role permission when task separating in the mean time.

Attribute-based access control policy specification language

This paper first introduces attribute expression to describe attribute-based access control policy.Secondly,an access control policy enforcement language named A-XACML （attribute-XACML）is proposed,which is an extension of XACML.A-XACML is used as a simple,flexible way to express and enforce access control policies,especially attribute-based access control policy,in a variety of environments.The language and schema support include data types,functions,and combining logic which allow simple and complex policies to be defined.Finally,a system architecture and application case of user-role assignment is given to show how attribute expressions and A-XACML work in access control policy description and enforcement.The case shows that attribute expression and A-XACML can describe and enforce the complex access control policy in a simple and flexible way.

Virus spreading in wireless sensor networks with a medium access control mechanism

In this paper, an extended version of standard susceptible-infected （SI） model is proposed to consider the influence of a medium access control mechanism on virus spreading in wireless sensor networks. Theoretical analysis shows that the medium access control mechanism obviously reduces the density of infected nodes in the networks, which has been ignored in previous studies. It is also found that by increasing the network node density or node communication radius greatly increases the number of infected nodes. The theoretical results are confirmed by numerical simulations.

A Multi-Tenant Usage Access Model for Cloud Computing

Most cloud services are built with multi-tenancy which enables data and configuration segregation upon shared infrastructures.It offers tremendous advantages for enterprises and service providers.It is anticipated that this situation will evolve to foster cross-tenant collaboration supported by Authorization as a service.To realize access control in a multi-tenant cloud computing environment,this study proposes a multi-tenant cloud computing access control model based on the traditional usage access control model by building trust relations among tenants.The model consists of three sub-models,which achieve trust relationships between tenants with different granularities and satisfy the requirements of different application scenarios.With an established trust relation in MT-UCON(Multi-tenant Usage Access Control),the trustee can precisely authorize cross-tenant accesses to the trustor’s resources consistent with constraints over the trust relation and other components designated by the trustor.In addition,the security of the model is analyzed by an information flow method.The model adapts to the characteristics of a dynamic and open multi-tenant cloud computing environment and achieves fine-grained access control within and between tenants.

Study on Mandatory Access Control in a Secure Database Management System

This paper proposes a security policy model for mandatory access control in class B1 database management system whose level of labeling is tuple. The relation hierarchical data model is extended to multilevel relation hierarchical data model. Based on the multilevel relation hierarchical data model, the concept of upper lower layer relational integrity is presented after we analyze and eliminate the covert channels caused by the database integrity. Two SQL statements are extended to process polyinstantiation in the multilevel secure environment. The system is based on the multilevel relation hierarchical data model and is capable of integratively storing and manipulating multilevel complicated objects ( e.g., multilevel spatial data) and multilevel conventional data ( e.g., integer, real number and character string).

Experience-Based Access Control in UbiComp: A New Paradigm

Experience is a sociological concept and builds over time. In a broader sense, the human-centered equivalents of experience and trust apply to D2D interaction. Ubiquitous computing (UbiComp) embeds intelligence and computing capabilities in everyday objects to make them effectively communicate, share resources, and perform useful tasks. The safety of resources is a serious problem. As a result, authorization and access control in UbiComp is a significant challenge. Our work presents experience as an outcome of history (HI), reliability (RL), transitivity (TR), and Ubiquity (UB). This experience model is easily adaptable to a variety of self-regulating context-aware access control systems. This paper proposes a framework for Experience-Based Access Control (EX-BAC) with all major services provided by the model. EX-BAC extends attribute-based access control. It uses logical device type and experience as context parameters for policy design. When compared with the state-of-the-art, EX-BAC is efficient with respect to response time.

Mobility Conscious Medium Access Control Scheme for Wireless Sensor Networks: A Conceptual Approach

Mobility in Wireless Sensor Network (WSN) presents distinctive challenges in Medium Access Control (MAC) scheme. Numerous MAC protocols for sensor networks assume that sensor nodes are static and focus primarily on energy efficiency. This work seeks to develop an improved mobility conscious medium access control scheme for wireless sensor networks with a view to enhance energy conservation on mobile sensor nodes. On this note, mobility patterns of different scenarios are modelled using Gauss Markov Mobility Model (GMMM) to determine the position and distance of the sensor nodes and how they are correlated in time.

零信任的安全模型研究

零信任被认为是一种新的安全范式,从安全模型视角,揭示了零信任架构以“身份和数据”为主线的安全模型深化与整合.零信任以身份为核心建立全景管控实体链条,围绕实体属性功能生命周期等建立深度防御,并集中重定向实体间信息的流动,整合信息通道,实现层层防护和细粒度动态化访问控制,最后从攻击者视角在信息流通道关键节点设置主动防御机制.由于零信任系统一定会成为高价值资产,探讨了零信任系统演进中与业务深度融合、零信任自身安全和弹性服务能力的新趋势.通过对零信任蕴含安全模型和自身安全性的分析,期望能够为零信任在应用中的架构设计、技术演进、应用安全提供更加清晰的技术发展路径.

基于策略的动态角色分配模型及应用

访问控制是应用系统中的重要问题之一。传统的基于角色的访问控制(RBAC)方案需要预先定义和同步用户-角色赋值关系,这会带来管理成本和同步开销,并且限制了应用系统的灵活性和动态性。文章提出一种基于策略的动态角色分配模型(Policy-based Dynamic Role Assignment Model——PDRA),它无需同步用户就可以自定义角色,并通过策略匹配的方式实现动态分配。模型完全兼容RBAC,可以成为RBAC良好的扩展机制。文章给出了模型的定义和算法,评估了模型的性能,并在华东师范大学的数据治理平台中进行了应用,验证了该方案的可行性和有效性。

基于RBAC模型的前后端分离系统设计与实现

权限管理是现代信息管理系统核心功能之一,能够让用户可以安全访问系统数据,其中基于角色的访问控制模型是常用的一种权限管理模型,其优点是能够灵活地处理角色与权限之间的变化问题,为复杂的权限管理问题提供便利性。另一方面前后端分离技术能够很好地解决前端页面开发和后端服务器功能开发解耦的问题,让分工双方更加注重各自面对的业务问题,减少对开发人员技术门槛的要求,从而大大提高了开发效率。因此采用前后端分离技术实现通用的基于角色的访问控制系统具有一定的实用价值。

统一驱动与能力抽象结合的无人机载荷虚拟化方法及实现

随着无人机及其集群应用不断深入并日益广泛,无人机载荷呈现种类多样、形态异构、接口复杂等特点,但同时要求系统能快速接入并高效管理载荷。为了解耦无人机载荷与系统平台的紧密关系,扩展对异构载荷的兼容能力,提出一种新型的载荷设备虚拟化方法。提出分层驱动模型,实现载荷硬件设备和驱动软件的解耦,使载荷设备接入过程标准化,该模型通过软硬件协同实现;提出基于“能力”的载荷抽象,解耦载荷应用功能及其设备实体;给出了载荷虚拟化方法具体实现及其典型验证实例。上述载荷设备虚拟化方法通过载荷应用、载荷驱动及载荷设备的软硬件解耦,增强了系统接入不同载荷的兼容性及扩展性,提高了统一管理多种载荷的效率。

数字技术使用、绿色认知与农户绿色防控技术采纳——以晋冀两省梨种植户为例

在数字乡村建设有序推进的背景下,明晰数字技术对农户绿色防控技术采纳的影响,对推进农业高质量发展意义重大。本文依据晋冀两省1 332份梨种植户调查数据,运用内生转换回归模型实证检验以数字技术接入和数字技术三个维度功能使用(信息查询、信息交流及网络销售)为表征的数字技术使用对农户绿色防控技术采纳的影响效应,并运用中介效应模型深入分析绿色认知在其中的作用路径。结果表明:(1)数字技术接入和数字技术功能使用均显著促进农户绿色防控技术采纳,且功能使用影响效应更大。(2)数字技术功能使用引致的农户绿色防控技术采纳提升效应大小依次为网络销售>信息交流>信息查询。(3)机制分析表明,农户绿色认知在数字技术接入对其绿色防控技术采纳影响中未发挥中介作用,而在数字技术功能使用对其绿色防控技术采纳影响中发挥中介作用,且中介效应大小依次为信息查询>信息交流>网络销售。(4)异质性分析表明,数字技术功能使用程度越深,对农户采纳绿色防控技术的提升效果越大。据此,建议扩大数字基础设施有效覆盖,全面提升农户数字技能;推动农户数字技术功能使用纵深发展;加强绿色农业生产宣传教育,提升农户绿色认知。

TA-BAC:基于有向无环图的访问控制模型

为解决传统访问控制模型存在有效期内策略获取困难、传输过程安全性低等问题,研究更细粒度、更具适用性的基于属性权能的访问控制模型(token attribute based access control, TA-BAC)。构建一种基于DAG区块链的TA-BAC访问控制模型;实现轻量化区块链存储,设计灵活的策略获取流程;引入基于属性的加密算法实现访问控制流程中凭证token的安全性增强机制。对优化后的访问控制模型进行分析验证,其结果表明,该模型具有较好的安全性和更高的性能,面对不同规模的访问控制场景具备良好的适用性。

高比例光伏接入的分布式储能容量自适应协调控制方法

光伏发电具有一定的波动性和不确定性,天气、季节等因素会导致光伏功率的变化,需要储能系统实时跟踪、预测和调整以保持供需平衡,但波动性和不确定性增加了控制的复杂性。为此,提出一种新的分布式储能容量自适应协调控制方法。计算接入高比例光伏电能后储能无功损耗,设置功率约束条件,确保功率的稳定性。基于此,以电压条件最优、接入负荷和净功率最低、高比例光伏接入处的功率可调节范围最优为调控目标,实现高比例光伏接入的分布式储能容量自适应协调控制。实验数据证明,所提方法在控制效果方面具有显著优势,能够实现高效的分布式储能控制,并确保光伏的高效出力。