partxvi-資料下載頁
2025-07-17 16:35本頁面
【正文】 – Separation of Duty – Data abstraction ? 完成機制 : 訪問控制 (Access Control) 2022/8/14 38 安全策略 ? 最早使用訪問控制方法的兩種 : ? 軍用： MAC(Mandatory Access Controls) – 軍方應用的安全目標： preventing the unauthorized observation of classified information. ? 民用： DAC(Discretinary Access Controls) – Integrity deals with broader issues of secrity than confidentiality – 特別是： funds transfer,clinical medicine,environmental research,air traffic control等行業(yè) – 每個企業(yè)都有自己唯一的安全需求，傳統(tǒng)的 DAC和 MAC難以滿足要求。 2022/8/14 39 安全策略 ? DAC的定義： – a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. – The controls are discretinary in the sense that a subject with a certain access permission is capable of passing that permission(perhanps indirectly) on to any other subject(unless restrained by mandatory access control) – 一言蔽之， DAC的特點是：用戶可不經(jīng)批準的把自己擁有的權(quán)限批準給其他人使用。 2022/8/14 40 安全策略 ? MAC的定義： – a means of restricting access to objects based on the sensitivity(as represented by a label)of the information contained in the objects and the formal authorization( clearance) of subjects to access inforamtion of such sensitivity. – 強調(diào)的是：嚴格限制什么級別的人訪問什么級別的信息。 2022/8/14 41 RBAC ? Permissons are associated with roles and users are mad members of appropriate rols. ? 更自然 ,符合組織管理方式 .greatly simplifies management of permissions. ? 與 DAC的主要不同 :The user cannot pass access permissions on to other users at their discretion. ? 更像 MAC ? MAC關(guān)心的是 who can read what 從高級流向低級權(quán)限 . ? RBAC更關(guān)心保護信息的 Integrity,也就是 “ Who can perform what acts on what information” ? 符合安全三原則 2022/8/14 42 summary ? PKI技術(shù)可以有效防止用戶的非法訪問和修改數(shù)據(jù)等問題 .但在瀏覽器客戶端實施尚不完善 ? 要保護內(nèi)部后臺數(shù)據(jù)庫的安全 ,可以實施 RBAC的策略 ,如果要進一步提供基于工作流的訪問控制 ,也可在 RBAC的基礎(chǔ)上完成 ..
語文相關(guān)推薦
鄂ICP備17016276號-1