面向数据跨域流转的延伸访问控制机制
|
摘要
针对复杂网络环境中数据跨域流转后的受控共享,提出了一种延伸访问控制机制。所提控制机制分为约束控制和传播控制2类,其中,约束控制解决访问请求实体在访问请求前对数据的访问授权问题,传播控制用于数据脱离数据中心后对数据的延伸控制。所提机制基于数据自身及数据流转过程中的起源信息,实现了对数据的直接和间接访问控制。理论分析证明了所提机制的安全性和有效性。以电子发票全生命控制为例,展示了所提机制的实施方法,该实例表明,所提机制能解决跨域跨系统交换后的数据细粒度延伸控制问题。
Aiming at the controlled sharing for cross-domain data exchange for complicated application systems, an extended access control mechanism was proposed. The control process was divided into two steps: constraint control and propagation control. The constraint control was used to ensure that access to data was authorized before access request, and the propagation control was used for further extension control after obtaining data access right. In addition, by considering data self and data provenance, the direct and indirect access control were realized. Theoretically, the security and effectiveness of the proposed mechanism were proved. Finally, taking the control of electronic invoice as an example, the implementation approach was proposed. The example shows that the proposed mechanism can perform the fine-grained extended control before and after data in the cross-domain and cross-system are exchanged.
Aiming at the controlled sharing for cross-domain data exchange for complicated application systems, an extended access control mechanism was proposed. The control process was divided into two steps: constraint control and propagation control. The constraint control was used to ensure that access to data was authorized before access request, and the propagation control was used for further extension control after obtaining data access right. In addition, by considering data self and data provenance, the direct and indirect access control were realized. Theoretically, the security and effectiveness of the proposed mechanism were proved. Finally, taking the control of electronic invoice as an example, the implementation approach was proposed. The example shows that the proposed mechanism can perform the fine-grained extended control before and after data in the cross-domain and cross-system are exchanged.
引文
[1]MYERS A C.JFlow:practical mostly-static information flow control[C]//Symposium on Principles of Programming Languages.1999:228-241.
[2]MYERS A C,LISKOV B.A decentralized model for information flow control[J].ACM SIGOPS Operating Systems Review,1997,31(5):129-142.
[3]KROHN M,YIP A,BRODSKY M,et al.Information flow control for standard OS abstractions[C]//The 21st ACM SIGOPS Symposium on Operating Systems Principles.2007:321-334.
[4]DOROTHY E.A lattice model of secure information flow[J].Communications of ACM,1976,19(5):236-243.
[5]BELL D E,LAPADULA L J.Secure computer system:unified exposition and multics interpretation,MTR-2997 Rev.1[R].Bedford,CA:MITRE Corporation,1976.
[6]BIBA K J.Integrity considerations for secure computer systems[R].USA:USAF Electronic Systems Division Mitre Corp Bedford MA,1977.
[7]ZELDOVICH N,BOYD-WICKIZER S.Securing distributed systems with information flow control[C]//USENIX Symposium on Networked Systems Design and Implementation.USENIX Association,2006:293-308.
[8]SHE W,YEN I L,BASTANI F,et al.Role-based integrated access control and data provenance for SOA based net-centric systems[J].IEEE Transactions on Services Computing,2016,9(6):940-953.
[9]SHE W,YEN I L,THURAISINGHAM B,et al.Security-aware service composition with fine-grained information flow control[J].IEEE Transactions on Services Computing,2013,6(3):330-343.
[10]ASUQUO P,CRUICKSHANK H,OGAH C P A,et al.A distributed trust management scheme for data forwarding in satellite DTNemergency communications[J].IEEE Journal on Selected Areas in Communications,2018,PP(99):1.
[11]LI Q,SANDHU R,ZHANG X,et al.Mandatory content access control for privacy protection in information centric networks[J].IEEETransactions on Dependable&Secure Computing,2017,PP(99):1.
[12]GROEF W D,DEVRIESE D,NIKIFORAKIS N,et al.FlowFox:a Web browser with flexible and precise information flow control[C]//The 2012 ACM conference on Computer and Communications Security(CCS).ACM,2012:748-759.
[13]SHE W,YEN I L,THURAISINGHAM B,et al.The SzCIFC model for information flow control in Web service composition[C]//IEEEInternational Conference on Web Services.2009:1-8.
[14]SHE W,YEN I L,THURAISINGHAM B,et al.Policy-driven service composition with information flow control[C]//IEEE International Conference on Web Services.2010:50-57.
[15]PARK J,DANG N,SANDHU R.A provenance-based access control model[C]//Tenth International Conference on Privacy,Security and Trust.2012:137-144.
[16]SUN L,PARK J,SANDHU R.Engineering access control policies for provenance-aware systems[C]//The Third ACM Conference on Data and Application Security and Privacy(COPASPY).ACM,2013:285-292.
[17]SUN L,PARK J,DANG N,et al.A provenance-aware access control frame work with typed provenance[J].IEEE Transactions on Dependable&Secure Computing,2016,13(4):411-423.
[18]李凤华,王彦超,殷丽华,等.面向网络空间的访问控制模型[J].通信学报,2016,37(5):9-20.LI F H,WANG Y C,YIN L H,et al.Novel cyberspace-oriented access control model[J].Journal on Communications,2016,37(5):9-20.
[2]MYERS A C,LISKOV B.A decentralized model for information flow control[J].ACM SIGOPS Operating Systems Review,1997,31(5):129-142.
[3]KROHN M,YIP A,BRODSKY M,et al.Information flow control for standard OS abstractions[C]//The 21st ACM SIGOPS Symposium on Operating Systems Principles.2007:321-334.
[4]DOROTHY E.A lattice model of secure information flow[J].Communications of ACM,1976,19(5):236-243.
[5]BELL D E,LAPADULA L J.Secure computer system:unified exposition and multics interpretation,MTR-2997 Rev.1[R].Bedford,CA:MITRE Corporation,1976.
[6]BIBA K J.Integrity considerations for secure computer systems[R].USA:USAF Electronic Systems Division Mitre Corp Bedford MA,1977.
[7]ZELDOVICH N,BOYD-WICKIZER S.Securing distributed systems with information flow control[C]//USENIX Symposium on Networked Systems Design and Implementation.USENIX Association,2006:293-308.
[8]SHE W,YEN I L,BASTANI F,et al.Role-based integrated access control and data provenance for SOA based net-centric systems[J].IEEE Transactions on Services Computing,2016,9(6):940-953.
[9]SHE W,YEN I L,THURAISINGHAM B,et al.Security-aware service composition with fine-grained information flow control[J].IEEE Transactions on Services Computing,2013,6(3):330-343.
[10]ASUQUO P,CRUICKSHANK H,OGAH C P A,et al.A distributed trust management scheme for data forwarding in satellite DTNemergency communications[J].IEEE Journal on Selected Areas in Communications,2018,PP(99):1.
[11]LI Q,SANDHU R,ZHANG X,et al.Mandatory content access control for privacy protection in information centric networks[J].IEEETransactions on Dependable&Secure Computing,2017,PP(99):1.
[12]GROEF W D,DEVRIESE D,NIKIFORAKIS N,et al.FlowFox:a Web browser with flexible and precise information flow control[C]//The 2012 ACM conference on Computer and Communications Security(CCS).ACM,2012:748-759.
[13]SHE W,YEN I L,THURAISINGHAM B,et al.The SzCIFC model for information flow control in Web service composition[C]//IEEEInternational Conference on Web Services.2009:1-8.
[14]SHE W,YEN I L,THURAISINGHAM B,et al.Policy-driven service composition with information flow control[C]//IEEE International Conference on Web Services.2010:50-57.
[15]PARK J,DANG N,SANDHU R.A provenance-based access control model[C]//Tenth International Conference on Privacy,Security and Trust.2012:137-144.
[16]SUN L,PARK J,SANDHU R.Engineering access control policies for provenance-aware systems[C]//The Third ACM Conference on Data and Application Security and Privacy(COPASPY).ACM,2013:285-292.
[17]SUN L,PARK J,DANG N,et al.A provenance-aware access control frame work with typed provenance[J].IEEE Transactions on Dependable&Secure Computing,2016,13(4):411-423.
[18]李凤华,王彦超,殷丽华,等.面向网络空间的访问控制模型[J].通信学报,2016,37(5):9-20.LI F H,WANG Y C,YIN L H,et al.Novel cyberspace-oriented access control model[J].Journal on Communications,2016,37(5):9-20.
© 2004-2018 中国地质图书馆版权所有 京ICP备05064691号 京公网安备11010802017129号 地址：北京市海淀区学院路29号 邮编：100083 电话：办公室：(+86 10)66554848；文献借阅、咨询服务、科技查新：66554700 |