Rcbac model introduces the context information and the group mechanism to the access control policies . in rcbac , the context information is used to control the user assignment and permission assignment dynamically and the group mechanism is used to simplify authorization further . thus , rcbac can implement the fine - grained access control and satisfy the enterprise ’ s demand for the unified resource access control 在对rbac的一些改进模型分析研究的基础之上提出了基于角色和上下文的访问控制模型( roleandcontext - basedaccesscontrol , rcbac ) , rcbac模型将上下文信息和组化机制引入到访问控制策略中,利用上下文信息动态地控制用户分配和权限分配,利用组化机制进一步简化授权,实现了细粒度的访问控制,满足了企业统一资源访问控制的需求。
Firstly , in this paper , we review the histories of xml and xml database , and all kinds of data models used widely now . then we review traditional access control policies and policies specially used on xml , and present a new expression method of access set on xml based on child tree of w3c data model . and we bring rbac model into xml database and present a new xml access model x - rbac . because the usage of data in databases has high frequency , we present an ids model based on access set density to logging the potential security threats . and then we introduce the design and implementation of a prototype of our native xml database nhx and its access control system . finally , we draw a conclusion for this paper and the future work 本文首先回顾了xml及xml数据库的历史,并总结了目前广泛使用的xml数据模型,在分析了各种传统数据库访问控制策略,以及xml的专有访问控制策略的优缺点后,基于w3c的xml数据模型,提出了一种基于子树的具有高弹性的便于实现的的访问区域表示法,并将rbac模型引入进来,提出了一种适用于xml数据库的访问控制模型x - rbac ,同时为了区分xml数据库访问中的合法访问和合理访问,我们根据数据库访问具有频繁性这一特征,提出了一种基于区域访问密度的入侵检测模型( ids ) ,以对隐藏在正常访问中的潜在安全威胁进行报警和日志。
The authentication is done using standard token sharing protocol of gss ( generic security service ) while authorization is done by simply looking for the client ' s dn in the database , then return a limited proxy certificate , which embeds the security policies relating with the requesting user in the virtual organization . ldap stores contents about certificate authority , object policy and locality information and so on . aces enhances the resource severs and enables them to recognize the access control policies embedded in the proxy certificates , and implements the fine - grained access control through combining its own policies with 访问控制决策子系统接受它所管辖的虚拟域内用户的请求,利用gss ( genericsecurityservice )标准令牌交换协议相互验证身份后,通过查询数据库得到用户相关的授权策略,并把授权策略写入到代理证书中,返回给请求用户; ldap目录服务器储存了ca证书、资源策略和位置信息等;访问控制实施子系统通过对应用程序授权部分进行扩展,使其支持嵌入在代理证书中的授权策略,并结合本地的安全策略做出最终决策。