ISE_11__Access-Control_

Size: px

Start display at page:

Download "ISE_11__Access-Control_"

艇古
5 years ago
Views:

1 Information Security Engineering Access Control Huiping Sun( ) sunhp@ss.pku.edu.cn

2 主要内容

3 参考书

4 访问控制简介

5 Introduction 访问控制定义 The process of granting or denying specific requests to: obtain and use information and related information processing services; and enter specific physical facilities. NIST IR 7298 A process by which use of system resources is regulated according to a security policy and is permitted only by authorized entities (users, programs, processes, or other systems) according to that policy. RFC 4949

6 Introduction 不同层次的访问控制

7 Introduction 访问控制与其余安全功能的关系

8 Introduction 访问控制策略和机制 Authorization Access Control Object Subject

9 Introduction 主体和客体

10 Introduction 权限 (X,Y,P) X Y P X Y

Introduction 最小特权原则 vs vs http://web.mit.

11 Introduction 最小特权原则 vs vs Every program and every privileged user of the system should operate using the least amount of privilege necessary to complete the job.

12 Introduction 一个简单的例子

13 访问控制模型

14 Model 访问控制模型 Access Control Model DAC MAC RBAC ABAC

15 Model 自主访问控制模型 Subject Subject Subject Subject Subject Subject Discretionary Access Control Object Object Object Object Object Object

16 Model 强制访问控制模型 Subject Subject Object Object Subject Object Subject Object Subject Subject Classification Categories Object Object Mandatory Access Control SELinux Solaris

17 Model MAC A B C D E Bell-LaPadula Biba BMA

18 Model 基于角色访问控制模型 Subject Subject Object Object Subject Object Subject Object Subject Subject Role Object Object Role Based Access Control

19 Model RBAC 模型

20 Model 基于属性的访问控制

21 Model 属性例子 ID URI Object Object

22 访问控制技术

23 Technology 访问控制矩阵

24 Technology 访问控制列表 vs 访问能力表

25 Technology UNIX 的文件访问控制 Unix

26 Technology RBAC: 用户和角色映射 Client Server User-role Authorization Server Client Server User-role Authorization Server Client Proxy Server Server User-role Authorization Server

27 Technology RBAC: 角色和客体

28 Technology XACML XACML OASIS IBM SAML XML XACML XACML

29 Technology XACML

30 Technology 其余技术 : 基于规则的访问控制 5M 5M 10M

31 Technology 其余技术 : 限制用户接口 ATM

32 Technology 其余 UCON

33 访问控制例子

34 Example 访问控制面临挑战细粒度海量分布式环境多变管理简单个性化互联互通

35 Analyze log Access Control Example 基于行为 Doctor Government Insurer Access Access Control Engine Access allowed EHR Doctor Write log Access Log Administrator policy? Policy Database Generate policy based on user behavior Patient Control? Behavior Analyze Engine

36 Example 基于信任 + 风险 + 博弈

37 Example 隐私设定问题 OSN vs vs

38 Example 基于朋友亲密度的 SNS 隐私控制

39 Example 访问控制设定推荐向导

40 Example 隐私设定推荐向导

41 身份管理介绍

42 Identity Management 参考书

43 Identity Management 数字身份

44 Identity Management 数字身份生命周期

45 Identity Management 定义 IDM IAM AIM

46 Identity Management 身份管理参与方 IdP

47 Identity Management 孤立的 IDM Identifier Credential Audi Josang and Simon Pope. User Centric Identity Management. In Proc. AusCERT 2005

48 Identity Management 联盟的 IDM Assertion SAML Liberty Allicance Shibboleth

49 Identity Management 集中的 IDM CA

50 Identity Management 单点登录的 IDM Kerberos Microsoft Passport

51 Identity Management 标准

52 Identity Management Web 服务安全标准 XrML Provisioning XML Encryption WS-Security Biometrics XML Signature XKMS SAML XACML W3C Architecture OASIS Joint Security

53 Identity Management 身份管理标准 XML XML XML XML SPML SPML SAML SPML XML XACML

54 Identity Management SPML Service Provisioning Markup Language SPML IT IT

55 Identity Management SPML ListTargets Add Lookup Modify Delete RA status cancel setpassword expirepassword resetpassword batch bulkmodify BulkDelete search iterate PST validatepassword suspend resume active closeiterator update iterate closeiterator PSP

56 Identity Management SAML Service Assertion Markup Language SAML Web

57 Identity Management 计算模式变迁

58 Identity Management 身份管理服务 Service IDM OS APP IDM APP IDM APP IDM App OS App Service IDM Service Service IDM Service APP APP OS App IDM Service OS IDM App Service Service IDM OS App APP 应系统服务系统

59 Homework 课后作业 PACMAN: Personal Agent for Access Control in Social Media. In IEEE Internet Computing 2017.

科研信息化技术与应用,2015, 6 (1) of identity and the framework of identity management, this paper analyses the development trend of Identity Management

科研信息化技术与应用,2015, 6 (1) of identity and the framework of identity management, this paper analyses the development trend of Identity Management 科研信息化技术与应用 2015, 6(1): 41 49 应用 / APPLICATION 身份管理发展趋势和中国科学院身份管理系统薛聪 1,2, 向继 1 1, 高能 1. 中国科学院信息工程研究所信息安全国家重点实验室, 北京 100093 2. 中国科学院大学, 北京