Research And Design Of Multi-Decision-Based Dynamic Access Control Model

Presently most access control systems are focusing on the identity of user. It is the mode that if the system determines the visitor's identity, it will provide authorization. Permissions or roles which are binded with permissions are assigned to user directly. This method is proved to be effective in many situations which they only need simple and low level access control security. With the development of information and application of Internet, the mode that authorization is only determined by user's identity can not meet the demand of some special requirement, such as some business and security requirement. When a valid user wants to access some resource, the terminal he using is not safe enough, or the net is in threat. At this time authorizing permission to user will be a dangerous action. In addition, with the increase of users and system scale, the maintence and management of permissions will generate more burdens on system admin. If we can consider some security aspects and use them in the access control system, such as the security degree of the whole environment or the health state of user's terminal, and make decision after all the elements are considered, then the system can meet the demand of those special can application.After the research on current access control model, this paper proposes the multi-decision-based dynamic access control mode. After the comparison between multi-aspects security decisions and the security policy of role, the system will authorize permission. As for a user, if his security decisions don't reach the demand of the system, His request will be forbidden.At first, I defined the basic elements and the relation among the elements in this model. The security decision set of user can be obtained by some original elements, such as identity, terminal and network state. On the other hand, the resources are binded with roles. Each role has several conditions. If the decision set of user can meet one of the conditions, the user can be assigned the role dynamically, and then the user can visit the resource which the roles are binded. The paper also proposes the access control architecture which are based on this model. There are two parts in the architecture: multi-information collection sub-system and dynamic decision sub-system. Multi-information collection sub-system can collect multi-aspect information and generate the original decisions; meanwhile dynamic decision sub-system matches the decision set with the condition of role, and realizes authorization. This is a more general, extendable, live and safe architecture. It can meet the strict requirement of those high security level access control system.After finishing the design of the sub-systems, this paper analysed the facts that can affect access control, and proposes the"Access Control Element Security Level Standard". Then the management commands set in this model are defined in mathematics, together with the realization of the management functions.