Khảo sát các mô hình và công nghệ kiểm soát truy cập cho điện toán đám mây

Springer Science and Business Media LLC - Tập 22 - Trang 6111-6122 - 2018
Fangbo Cai1, Nafei Zhu1, Jingsha He1, Pengyu Mu1, Wenxin Li1, Yi Yu1
1Faculty of Information Technology, Beijing University of Technology, Beijing, China

Tóm tắt

Kiểm soát truy cập là một biện pháp quan trọng nhằm bảo vệ thông tin và tài nguyên hệ thống để ngăn chặn người dùng trái phép truy cập vào các đối tượng được bảo vệ và người dùng hợp pháp cố gắng truy cập vào các đối tượng theo những cách vượt quá quyền hạn của họ. Các hạn chế đối với việc truy cập từ một chủ thể đến một đối tượng được xác định bởi chính sách truy cập. Với sự phát triển nhanh chóng của điện toán đám mây, an ninh đám mây ngày càng trở thành một mối quan tâm phổ biến và cần được xử lý một cách nghiêm túc. Trong bài báo này, chúng tôi khảo sát các mô hình và chính sách kiểm soát truy cập trong các kịch bản ứng dụng khác nhau, đặc biệt là cho điện toán đám mây, bằng cách theo dõi sự phát triển của internet như một dòng chính và xem xét các môi trường mạng và yêu cầu của người dùng khác nhau. Chúng tôi tập trung vào các mối quan hệ giữa các mô hình và công nghệ khác nhau cùng với các kịch bản ứng dụng cũng như ưu và nhược điểm của từng mô hình. Đặc biệt chú ý sẽ được đặt vào kiểm soát truy cập cho điện toán đám mây, điều này được phản ánh trong các tóm tắt về các mô hình và phương pháp kiểm soát truy cập. Chúng tôi cũng xác định một số vấn đề mới nổi trong kiểm soát truy cập và chỉ ra một số hướng nghiên cứu tương lai cho điện toán đám mây.

Từ khóa

#Kiểm soát truy cập #điện toán đám mây #mô hình kiểm soát truy cập #chính sách truy cập #an ninh mạng.

Tài liệu tham khảo

Li, F.H., Xiong, J.B.: Access control technology for complex network environment. The people’s mail and telecommunications press (2015)

Bell, D.E., LaPadula, L.J.: Secure computer system: unified exposition and multics interpretation. DTIC Document, Mitre Corp Bedford MA, USA (1976)

Sandhu, R., Coyne, E.J., Feinstein, H.L., et al.: Role-based access control models. Computer 29(2), 38–47 (1996)

Sandhu, R., Bhamidipati, V., Munawer, Q.: The ARBAC97 mode for role-based administration of roles. ACM Trans. Inf. Syst. Secur. (TISSEC) 2(1), 105–135 (1999)

Sandhu, R., Munawer, Q.: The ARBAC99 model for administration of roles. In: Proceedings of 15th Annual Computer Security Applications Conference, pp. 229–238. IEEE, New York, NY, USA (1999)

Oh, S., Sandhu, R., Zhang, X.: An effective role administration model using organization structure. ACM Trans. Inf. Syst. Secur. (TISSEC) 9(2), 113–137 (2006)

Ferraiolo, D.F., Sandhu, R., Gavrila, S., et al.: Proposed NIST standard for role-based access control. ACM Trans. Inf. Syst. Secur. (TISSEC) 4(3), 224–274 (2001)

Thomas, R.K., Sandhu, R.: Task-based authorization controls (TBAC): a family of models for active and enterprise-oriented authorization management. In: Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Security XI: Status and Prospects, pp. 166–181. Chapman & Hall, Ltd., London, UK (1998)

Oh, S., Park, S.: Task-role-based access control model. Inf. Syst. 28(6), 533–562 (2003)

Zhu, J.: Research on Group Perception and Access Control Technology in Role Coordination. College of computer science, Zhongshan University, Guangzhou (2009)

Bertino, E., Ferrari, E., Atluri, V.: The specification and enforcement of authorization constraints in workflow management systems. ACM Trans. Inf. Syst. Secur. 2(1), 65–104 (1999)

Knorr, K.: Dynamic access control through Petri net workflows. In: 16th Annual Conference on Computer Security Applications, pp. 159–167 (2000)

Botha, R.A., Eloff, J.H.P.: Designing role hierarchies for access control in workflow systems. In: Proceedings of the 25th International Computer Software and Applications Conference, pp. 117–122. IEEE Computer Society, Washington, DC, USA (2001)

Curry, S., Darbyshire, J., Fisher, D.W., Hartman, B., Herrod, S., Kumar, V., Martins, F. et al.: Infrastructure security: getting to the bottom of compliance in the cloud. The Security Division of EMC (2010)

Kaur, P.J., Kaushal, S.: Security concerns in cloud computing. In: Proceedings of the HPAGC 2011. CCIS, vol. 169, pp. 103–112(2011)

Shen, H.B., Hong, F.: Review of access control model. Appl. Res. Comput. 22(6), 9–11 (2005)

Han, D.J., Gao, J., Zhai, H.L., et al.: Research progress of access control model. Comput. Sci. 37(11), 29–33 (2010)

Lampson, B.W.: A scheduling philosophy for multiprocessing systems. Commun. ACM 11(5), 347–360 (1968)

Luo, Y., Wu, Z.H.: A new method of access control policy descriptive language and its authorization. J. Comput. 1-18 (2017)

Cantor, S., Moreh, J., Philpott, R., Maler, E.: Metadata for the OASIS security assertion markup language (SAML) V2.0. OASIS Open, (2005)

Gary, C., Sun, M.: OASIS service provisioning markup language (SPML) versions 2.0. OASIS Open (2006)

Erik, R., Axiomatics, B.: OASIS extensible access control markup language (XACML) versions 3.0. OASIS Open (2013)

Lv, S., Liu, L., Shi, L., et al.: Intelligent planning method based on automatic reasoning technology. J. Softw. 20(5), 1226–1240 (2009)

Li, N., Tripunitaram, V.: Security analysis in role based access control. ACM Trans. Inf. Syst. Secur. 9(4), 391–420 (2006)

Lin, B.G.: Analysis of extended information system security domain model. J. Commun. 9–14 (2009)

Ye, Y., Lu, T., et al.: Triple helix model and its quantitative analysis methods. China Soft Sci. 11, 131–139 (2014)

Liu, Q.: Role-based access control techniques, South China University of technology press, pp. 55–60 (2010)

He, Z., Tian, J., Zhang, Y.: Style refinement and detection improvement of policy conflict. J. Jilin Univ. 25(3), 287–293 (2005). (in Chinese)

Yao, J., Mao, B., Xie, L.: A DAG-based security policy conflicts detection method. J. Comput. Res. Dev. 42(7), 1108–1114 (2005). (in Chinese)

Lupu, E.C., Sloman, M.: Conflicts in policy based distributed systems management. IEEE Trans. Softw. Eng. 25(6), 852–869 (1999)

Cholvy, L., Cuppens, F.: Analyzing consistency of security policies. IEEE Symposium on Security & Privacy, IEEE, pp. 103–112 (1997)

Li, X., Meng, L., Jiao, L.: Problems in results of policy conflict resolutions and detection and resolution methods in network management systems. J. Comput. Res. Dev. 43(7), 1297–1303 (2006). (in Chinese)

Li, R.X., Lu, J.F., Li, T.Y., et al.: A method of inconsistency conflict resolution for access control strategy. J. Comput. 36(06), 1210–1223 (2013)

Lu, J.F., Yan, X., Peng, H., Han, J.M.: An optimized strategy for inconsistent conflict resolution. J. Huazhong Univ.Sci.Technol. 42(11), 106–111 (2014)

Feng, D.G., Zhang, M., Zhang, Y.: The security research of cloud computing. J. Softw. 22(1), 71–83 (2011)

Bertino, E., Ferrari, E., Atluri, V.: The specification and enforcement of authorization constraints in workflow management systems. ACM Trans. Inf. Syst. Secur. 2(1), 65–104 (1999)

Thomas, R.K., Sandhu, R.: Task-based authorization controls (TBAC): a family of models for active and enterprise oriented authorization management. In: Proceedings of the 11th IFIP WG11.3 Conference on Database Security, pp. 166–181. Lake Tahoe (1997)

Li, F.H., Su, M., Shi, G.Z., Ma, J.F.: Research status and development trends of access control model. Chin. J. Electron. 40(4), 805–813 (2012). (in Chinese with English abstract)

Botha, R.A., Eloff, J.H.P.: Designing role hierarchies for access control in workflow system. The 25th Annual International Computer Software and Applications Conference Chicago, pp. 117–122 (2001)

Wang, X.W., Zhao, Y.M.: A task-role-based access control model for cloud computing. Comput. Eng. 38(24), 9–13 (2012)

Deng, J.B., Hong, F.: Task-based access control model. J. Softw. 14(1), 76–96 (2003)

Park, S.: Task role based access control: an improved access control model for enterprise environment. The 11th International Conference in Database and Expert Systems Applications. pp. 264–273. London (2000)

Androulaki, E., Soriente, C., Malisa, L. et al.: Enforcing location and time based access control on cloud stored data. The 34th International Conference on Distributed Computing systems. pp. 637–648 (2014)

Li, F.H., Wang, W., Ma, J.F., et al.: Action based access control model. Chin. J. Electron. 17(3), 396–401 (2008)

Li, F.H., Wang, W., Ma, J.F., et al.: Action based access control model and its behavior management. J. Electron. 36(10), 1881–1890 (2008)

Li, F.H., Wang, W., Ma, J.F., et al.: The access control model of cooperative information system and its application. J. Commun. 29(9), 116–123 (2008)

Li, F.H., Wang, W., Ma, J.F., et al.: Action based access control for web services. The 5th International Conference on Information Assurance and Security, pp. 637-642. Xi’an, (2009)

Lin, G.Y., He, S., Huang, H., Wu, J.Y., Chen, W.: Access control security model based on behavior in cloud computing environment. J. Commun. 33(3), 59–66 (2012)

Yuan, E., Tong, J., Zhao, Z.: Attributed based access control (ABAC) for web services. The IEEE International Conference on Web Services, Orlando, Florida. pp. 561–569 (2005)

Wang, X.M., Fu, H., Zhang, C.L.: Research progress on properties based access control. J. Electron. 38(07), 1660–1667 (2010)

Ei, E.M., Thinn, T.N.: The privacy-aware access control system using attribute-and role-based access control in private cloud. Proceedings of the 2011 4th IEEE IC-BNMT. pp. 447–451 (2011)

Parkark, J., Sandhu, R.: Towards usage control models: Beyond traditional access control. Proceedings of the 7th ACM Symposium on Access Control Models and Technologies, pp. 57–64. ACM press, Monterey California (2002)

Chu, X.B., Qin, Y.: A distributed control system based on trusted computing. J. Comput. 33(1), 93–102 (2010)

Tavizi, T., Shajari, M., Dodangeh, P.: A usage control based architecture for cloud environments. Parallel and Distributed Processing Symposium Workshops & PhD Forum (IPDPSW), 2012 IEEE 26th International. pp. 1534–1539, IEEE (2012)

Park, J., Sandhu, R.: The UCON ABC usage control model. ACM Trans. Inf. Syst. Secur. 7(1), 128–174 (2004)

Mounira, M., Rached, A., Ahmed, S.: Access control in probative value cloud. In: Proceedings of the 8th International Conference for Internet Technology and Secured Transactions (2013)

Park, J., Zhang, X.W., Sandhu, R.: Attribute mutability in usage control. In: Proceedings of the Annual IFIP WG Working Conference on Data and Applications Security, pp. 15-29 (2004)

Zhang, X.W., Nakae, M., Covington, M.J., et al.: Toward a usage-based security framework for collaborative computing systems. ACM Trans. Inf. Syst. Secur. 11(1), 1–36 (2008)

Park, J.: Usage Control: A Unified Framework for Next Generation Access Control. George Mason University, Virginia (2003)

Zhang, X.W., Parisi-Presicce, F., Sandhu, R., et al.: Formal model and policy specification of usage control. ACM Trans. Inf. Syst. Secur. 8(4), 35–87 (2005)

Dong, Q.X., Guan, Z., Chen, Z.: An overview of computational cryptography on cryptographic data. Appl. Res. Comput. 33(09), 2561–2572 (2016)

Vipul, G., Amit, S., Omkant, P., Brent, W.: Attribute-based encryption for fine-grained access control of encrypted data. In: Proceedings of the ACM Conference on Computer and Communications Security. pp. 89-98 (2006)

Ostrovsky, R., Sahai, A., Waters, B.: Attribute-Based encryption with non-monotonic access structures. In: Proceedings of the 14th ACM Conference on Computer and Communications Security. pp. 1–17. ACM Press, New York (2007)

Attrapadung, N., Imai, H.: Conjunctive broadcast and attribute-based encryption. In: Shacham, H., Waters, B. (eds.) Pairing-Based Cryptography-Pairing 2009, pp. 248–265. Springer-Verlag, Berlin (2009)

Shu, J.S., Cao, D., Wang, X.F.: Attribute based encryption mechanism. J. Softw. 22(6), 1299–1315 (2011)

Xiong, J.B., Yao, Z.Q., Ma, J.F., et al.: A portfolio document model and access control scheme in a cloud computing environment. J. Xi’an Jiao Tong Univ. 48(2), 25–31 (2014)

Liu, X., Zhang, Y., Wang, B.: Mona: secure multi-owner data sharing for dynamic groups in the cloud. IEEE Trans. Parallel Distrib. Syst. 24(6), 1182–1192 (2013)

Chen, S.H., Chen, R.J.: Dealer less multi server timed release encryption scheme with privacy preserving encoding. The Second International Conference on Information Security and Digital Forensics, p. 1 (2005)

Unruh, D.: Revocable quantum timed release encryption. The 33th Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 129–146. Springer Verlag, Copenhagen, Heidelberg (2014)

Zhou, L., Varadharajan, V., Hitchens, M.: Enforcing role based access control for secure data storage in the cloud. Comput. J. 54(10), 1675–1687 (2011)

Zhu, Y., Hu, H.X., et al.: Provably secure role based encryption with revocation mechanism. J. Comput. Sci. Technol. 26(4), 697–710 (2011)

Shamir, A.: Identity Based Crypto Systems and Signature Schemes. CRYPTO 84 on Advances in Cryptology. Springer Verlag, New York (1985)

Sahai, A., Waters, B.: Fuzzy identity based encryption. The 24th Annual International Conference on Theory and Applications of Cryptographic Techniques, pp. 457–473. Springer Verlag, Berlin Heidelberg (2005)

Wang, Y.D., Yang, J.H., Xu, C., et al.: Survey on access control technologies for cloud computing. J. Softw. 26(5), 1129–1150 (2015)

Thông tin
Thông tin xuất bản

Springer Science and Business Media LLC

Tập 22

6111-6122

Thông tin tác giả