Dünaamiline rollipõhine ligipääsu kontroll XML dokumentidele
Date
2013
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Tartu Ülikool
Abstract
Tänapäeval hoitakse enamus dokumente elektroonsetel andmekandjatel. Samaaegselt kasvab andmete maht ja vajadus nende kiireks transportimiseks. Dokumendid võivad sisaldada salajast või infot, mis valede osapoolte käes võib olla ohtlik või tähendada äririske, mis tekitab vajadust dokumentide sisu kaitsta. Peamiselt käsitletakse dokumenti kui tervikut – kuulutatakse terve dokument näiteks salastatuks. Selline lähenemisviis ei ole alati põhjendatud ja osaliselt võib dokumendi sisu siiski olla avalik: näiteks anonüümsete uuringute tegemiseks.
Rollipõhine ligipääsu kontroll (inglise keeles – Role Based Access Control) on meetod defineerimaks kasutajate õiguseid infosüsteemis vastavalt neile omistatud rollidele. Turvameetmete defineerimine ja realiseerimine on aeganõudev töö, mida tihti tehakse paralleelselt või pärast rakenduse loogika realiseerimist.
Lahenduseks probleemile pakume rollipõhist ligipääsukontrolli dünaamiliselt defineeritavatele dokumentidel. Kuna dokumendid võivad olla oma mahult suured, siis defineerime õigused dokumendi struktuuri tasandil (XML Schema). Kontrolli ja dokumendi vormi modelleerimiseks kasutame SecureUML notatsiooni, mis on UML’i laiendus. Antud mudelist genereerime SQL koodi, mida andmebaasis jooksutades saame muudatused viia mudelist serveri rakendusse. Server vastutab antud privileegide ja dokumendi struktuuri kaitstud osade eest ja annab välja ainult antud rollile lubatud infot.
Antud töö raames teostatud uuring näitas, et on võimalik modelleerida nii vorm kui õigused nii, et ligipääsupiiranguid omavad andmed on kaitstud. Kuvatavate andmete muutmisel ja lisamisel ei rikuta olemasoleva dokumendi terviklikkust ja andmed säilivad.
Nowadays most of documents are held in digital form. Often document repositories or databases are used to store the info. The info is getting bigger in size and needs to be transferred to partner parties faster. The documents can contain delicate info that not all the actors on the partner side should see and edit. This leads to the need of restricting the actions that a user can do with the document and see in the document. In this work we research possibility to integrate existing technologies to dynamically define forms and their security. For the solution we will introduce a dynamic way to define security on XML documents. As the info transferred might be high in integrity and confidentiality, we need to keep in mind that despite restricting and giving permissions to user we must also always keep the integrity of the document. In order to fill these needs we will introduce a document structure based Role Based Access Control on each of the document’s info element together with a merging strategy to keep document’s integrity. We will validate the approach with a case study following a set of business scenarios: check whether our solution can capture all permissions, roles and subjects from the model and whether the document content stays complete when the document is manipulated.
Nowadays most of documents are held in digital form. Often document repositories or databases are used to store the info. The info is getting bigger in size and needs to be transferred to partner parties faster. The documents can contain delicate info that not all the actors on the partner side should see and edit. This leads to the need of restricting the actions that a user can do with the document and see in the document. In this work we research possibility to integrate existing technologies to dynamically define forms and their security. For the solution we will introduce a dynamic way to define security on XML documents. As the info transferred might be high in integrity and confidentiality, we need to keep in mind that despite restricting and giving permissions to user we must also always keep the integrity of the document. In order to fill these needs we will introduce a document structure based Role Based Access Control on each of the document’s info element together with a merging strategy to keep document’s integrity. We will validate the approach with a case study following a set of business scenarios: check whether our solution can capture all permissions, roles and subjects from the model and whether the document content stays complete when the document is manipulated.