KR100697995B1 - Context role based access control and mandatory access control fussion method in ubiquitous environments - Google Patents

Abstract

In the ubiquitous environment, the present invention collects user's location and situation information by an environment device, filters the information collected by the environment device, and separates the information into necessary and unnecessary information. Classifies the privacy information and the non-privacy information, and when the user requests the privacy information, the privacy information is accessed according to the access control constraint according to the user's role, and when the non-privacy information is requested, the restriction is applied. It provides a contact role-based access control and mandatory access control convergence authentication method in a ubiquitous environment characterized by providing information without going through.

Description

Context role based access control and mandatory access control fussion method in ubiquitous environments}

1 is a block diagram of a basic access control system for implementing the present invention;

2 is a conceptual diagram illustrating a contact role-based access control and mandatory access control convergence model in a ubiquitous environment according to the present invention;

3 is a view conceptually comparing a resource utilization state by a method according to the present invention with a resource utilization state according to a conventional method;

4 is a conceptual diagram illustrating a hierarchical structure of an embodiment for explaining the method of the present invention.

The present invention considers privacy and non-privacy information in a ubiquitous environment, and provides privacy information with a limit according to the role of the user, thereby preventing the risk of leakage, and for the non-privacy information, A contact role based access control and mandatory access control convergence authentication method provided to a user without the same limitation.

So far, various data approaches have been proposed, but most of them have static methods by the system operator and access control policies suitable for ubiquitous environments without time and space restrictions on data access are not considered.

Generally, the purpose of data access control is to allow a user with proper authority to access a system and obtain information, and to prevent an illegal user or a malicious application from causing data change or loss. Puts.

Representative access control techniques studied so far include discretionary access control (DAC), mandatory access control (MAC), and role based access control (RBAC).

However, discretionary access control (DAC) is a method in which an owner or administrator of an information object grants access rights to other users according to an autonomous decision without the intervention of a security manager, and in an environment where information sharing is more important than information protection. Suitable. However, it is not suitable for the ubiquitous environment such as the possibility of information leakage.

Compulsory access control (MAC) compares the classification level associated with each piece of information and the clearance level granted to the user with the rules defined in advance, and grants access only to users who meet those rules. This policy is used in an environment where the confidentiality of information is very important. However, it is not suitable in ubiquitous environment because all objects are restricted.

Role-based access control (RBAC) allows subject-Centric constraints to grant access rights according to roles and allow users to perform tasks by assigning appropriate roles and specific role positions (Role Hierarchies). By assigning to, only the minimum resources needed to perform the role are accessible. However, since RBAC is subject-centered, it does not support various object attributes to access (access) objects and does not provide the function to determine the role environment status such as role location and situation. In addition, RBAC cannot support time-dependent access control.

The present invention has been made in consideration of the above situation, and in the ubiquitous environment, in consideration of privacy and non-privacy information, privacy information is limited according to the role of the user and according to the user's grade. The purpose of the present invention is to provide a contact role-based access control and mandatory access control convergence authentication method, which prevents the risk of leakage and provides non-privacy information to users without the above restrictions.

In addition, the present invention provides the information according to the role of the user as described above, so that all the contact information (context information) or situation information (situation information), without searching all the resources of the database, the database corresponding to the role It is an object of the present invention to provide a contact role-based access control and mandatory access control convergence authentication method that facilitates resource utilization by searching only a portion of a resource.

In order to achieve the above object, in the ubiquitous environment, the present invention collects the location and situation information of the user by the environmental device, and filters the information collected by the environmental device, separating the necessary information and unnecessary information, Classify the privacy information and non-privacy information granted by the role for the separated information, and when the user requests the privacy information, the privacy information is accessed according to the access control constraints according to the role of the user, and the non-privacy information If requested, provides a contact role-based access control and mandatory access control convergence authentication method in a ubiquitous environment, characterized in that the information is provided without passing through the constraint.

Hereinafter, a contact role based access control and mandatory access control authentication method in a ubiquitous environment according to the present invention will be described in detail.

A basic access control system for implementing the present invention according to FIG. 1 includes a DB server 10 in which contact information or context information and privacy and non-privacy information required by a user are stored, and a user. Manages the sensor network and the privacy and non-privacy information comprising a sensor (RFID, Smart Card, other sensor capable of recognizing contact), which is a means for recognizing a request for providing information, and according to the present invention, It includes a computer 20 that is an authentication server for performing the access control policy of.

(1) Context RBAC / MAC Authorization Model will be described.

First, access control policies such as MAC, DAC, RBAC, etc. are mutually exclusive policies. In other words, if an organization or system selected a particular access control policy, it could not accept other policies. As the complexity of organizations and systems and various demands for data protection increase, the necessity of multi-policy access control to apply a plurality of access control policies simultaneously is emerging. Therefore, we propose a new access policy for the ubiquitous environment and a new multi-policy access control Context Role / MAC Authorization model that can integrate this access control policy with existing access control policies.

In the existing RBAC, a role can exercise authority over all objects that correspond to the role. However, when the majority of users own the same role, that role grants the same privileges to the majority of users. This can be interpreted to mean that if multiple users belong to the same role, all information about the role becomes accessible.

In this case, since a problem arises in that the object cannot be restricted, as shown in FIG. 2, for example, a plurality of users are assigned the same role by applying a plural policy that fuses the contact, MAC, and RBAC. Even if they receive a role, a grade is assigned to the role so that only data based on that grade is accessible. In addition, applying a contact to such a multi-policy model can provide more efficient and powerful control than the context applied in the existing RBAC.

The biggest advantage of applying Context to multiple policies is when the user requests arbitrary arguments. In this case, Context information is used to service the information that meets the user's needs. As shown in FIG. 3A, in the existing method of applying the context to the RBAC, all the information corresponding to the role is found and provided. In the multi-policy according to the present invention in which the context is applied to the RBAC and the MAC, a role grade is given, so that only the information needs to be retrieved according to the corresponding grade of the role. That is, instead of retrieving all the information about the object, only the part of the object is retrieved according to the role of the role (for example, when the grade according to the role of a predetermined user is a C grade, according to each grade). Only class C part of the allowed object will be searched).

(2) Contact role based access control and mandatory access control hierarchy (Context RBAC / MAC Architecture)

Context Roles are designed so that the subject can obtain the necessary data based on the current user's context information.

As shown in FIG. 4, an environment device or a sensor is configured of a sensor, an RFID, a smart card, and the like to collect information in order to collect user's location and situation information. Information collected by the environmental device, such as data such as Date, Time, IP Address, Location, Action, Condition, and the like, is filtered and required by a contact collection unit (Context Collection), which may be one of the components of the computer 20. And unnecessary information.

In addition, the ubiquitous relation manager (uT Relation Manager), which may be one of the components of the computer 20, classifies the privacy information and the non-privacy information granted by the role to the separated information. Then, by analyzing the classified privacy information, if the user requests the privacy information in the current situation, it has access control constraints for confidentiality and privacy protection of the role. In FIG. 4, the above roles are classified into four grades, and four types of information (top secret, secret, confidential, and unclassified) are accessible according to each role.

On the other hand, when non-privacy information is not required for a role, the information is provided using the database 10 without restriction.

The present invention proposed a personally controlled access control model that maintains confidentiality and integrity of personal information under the ubiquitous environment. While the existing model does not consider the policy aspects of individuals in the ubiquitous environment, the proposed model considers privacy aspects and general non-privacy aspects to individuals, and puts constraints on objects to prevent information leakage. In this regard, we proposed a more powerful control method and provided the information requested by the user in consideration of the fluid aspect of ubiquitous about non-privacy.

By using the method according to the present invention, it is expected to be a big foundation for security related field based on ubiquitous environment in the future.

Claims (2)

In a ubiquitous environment, Collecting location and situation information of the user by the environmental device, Filtering the information collected by the environmental device in a contact collector to separate the information; Classifying the separated information into privacy information and non-privacy information by a ubiquitous related manager; If the user requests the privacy information, accessing the privacy information according to the access level of the user; and If the non-privacy information is requested, contact role-based access control and mandatory access control convergence authentication method in a ubiquitous environment, characterized in that the step of providing information using a database regardless of the user's access level. The method of claim 1, wherein the information collected by the environment device is Date, Time, IP Address, Location, Action, Condition.

Images