group hierarchies with decentralized user assignment in windows ntnew

《group hierarchies with decentralized user assignment in windows ntnew》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、GROUPHIERARCHIESWITHDECENTRALIZEDUSERASSIGNMENTINWINDOWSNTRAVISANDHUandGAIL-JOONAHNGeorgeMasonUniversityAbstractitlydisplayedwiththeUserManagerprogram.Win-dowsNTnotablylacksafacilityforincludingonegroup1ThenotionofgroupsinWindowsNTismuchlikethatinanother.Inpractice,itisofte

2、ndesirablethatinotheroperatingsystems.Ratherthansetuserandgroupsbearsomerelationshiptoeachother.Byal-lerightsindividuallyforeachandeveryuser,thead-lowingmembershipinagrouptoautomaticallyim-ministratorcangiverightstovariousgroups,thenplaceplymembershipinsomeothergroupswecanr

3、educeuserswithinthosegroups.InthispaperwedescribeanthenumberofexplicitaccessdecisionsthatneedtobeexperimenttoextendtheWindowsNTgroupmecha-madebyusersandadministrators.Manycommercialnismintwosignicantwaysthatareusefulinmanagingdatabasemanagementsystems,suchasInformix,Ora-gro

4、up-basedaccesscontrolinlarge-scalesystems.ThecleandSybase,providefacilitiesforhierarchicalgroupsgoalofourexperimentistodemonstratehowgrouphi-(orroles).Commercialoperatingsystems,however,erarchies(wheregroupsincludeothergroups)andde-providelimitedfacilitiesatbestforthispurpos

5、e.centralizeduser-groupassignment(whereadministra-AnotherlimitationofWindowsNTgroupsisthattorsareselectivelydelegatedauthoritytoassigncer-membershipisexclusivelycontrolledbybuilt-inadmin-tainuserstocertaingroups)canbeimplementedbyistratorgroupssuchasAccountOperators,Administ

6、ra-meansofMicrosoftremoteprocedurecall(RPC)pro-tors,andDomainAdmins[4].Thisisacentralizedgrams.Inbothrespectstheexperimentalgoalistomodelwhichdoesnotscalegracefullytosystemswithimplementpreviouslypublishedmodels(RBAC96forlargenumbersofgroupsandusers.Moregenerally,itgrouphier

7、archiesandURA97fordecentralizeduser-ispossibletodecentralizeuser-groupassignmentbyal-groupassignment).OurresultsindicatethatWindowslowingadministratorstoselectivelydelegateauthorityNThasadequate exibilitytoaccommodatesophisti-toassigncertainuserstocertaingroups.catedaccessco

8、ntrolmodelstosomeextent.InthispaperwedescribeanexperimenttoextendtheWindows