以角色為基礎之存取控制模型實作之研究

Abstract

傳統上存取控制的方法如「強制的存取控制」（Mandatory Access Control, MAC）、「自由裁決的存取控制」（Discretionary Access Control, DAC）等已無法滿足複雜的企業環境需求，於是美國國家標準局 （NIST）提出了「以角色為基礎的存取控制」（Role-Based Access Control, RBAC）。在RBAC中，使用者皆被分配到適當的角色，而資源的 存取權限則是經由所屬的角色來決定。 目前關於RBAC實作的討論，現 有文獻皆著重於較低階的實作問題，關於管理工具的製作，以及如何儲存 管理者設定的存取控制規則等問題卻較少討論。同時現有文獻也多是針對 特定的系統或特定的需求，對於系統開發者而言，若要將抽象的RBAC模型 落實於真實的系統中，勢必還要花費一番思考的功夫。 在本研究中， 我們從RBAC做為溝通現實世界與電腦系統的橋樑角色出發，提出了一個通 用的實作模式，說明了在實作RBAC之時，系統中應存在的三個元件：RBAC 管理工具、RBAC資料庫、RBAC執行時期系統，以及此三個元件所組成的架 構；接著我們討論了這三個元件的實作方法，以及可能遇到的問題與解決 方法；最後在資策會已開發之防火牆架構下，根據此實作模式設計與實作 存取控制的機制。我們相信，藉由此模式的提出，應能提供系統開發者思 考的方向，快速而正確地開發RBAC的系統。 Traditional access control methods, such as mandatory access control(MAC) and discretionary access control (DAC), cannot satisfy the needs of today's enterprises. The role-based access control (RBAC), suggestedby National Institute of Standards and Technology (NIST), is the solution. In RBAC, permissions are associated with roles, and users are made members of appropriate roles thereby acquiring the roles' permissions. Most papers on RBAC emphasize on the implementation issues. They seldom discuss how to write an administration tool and how to store theaccess control rules specified by administrators. Their approaches are usually ad hoc solutions. For system developers, it will take them a lotof energy to put the abstract RBAC model into practice. Therefore, by treating RBAC as a bridge between the real world and computer system, we proposed a general implementation model in this thesis. Three componentsmust exist in an RBAC system: the RBAC administration tool, the RBAC database, and the RBAC run-time system. We examined the structure of these three components. Then, we explained how to implement these three components, and discussed the problems we might encounter and the solutions to solve them. Finally, according to this implementation model, we designed and implemented an access control module for firewall. We believe this implementation model is helpful to system developers for developing the RBAC system quickly and correctly.