资源描述：
《Chapter 4 Access Control》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、CHAPTER4AccessControlGoingallthewaybacktoearlytime-sharingsystemswesystemspeopleregardedtheusers,andanycodetheywrote,asthemortalenemiesofusandeachother.Wewerelikethepoliceforceinaviolentslum.—RogerNeedhamMicrosoftcouldhaveincorporatedeffectivesecuritymeasuresasstandard,butgoodsenseprevailed.S
2、ecuritysystemshaveanastyhabitofbackfiringandthereisnodoubttheywouldcauseenormousproblems.—RickMaybury4.1IntroductionAccesscontrolisthetraditionalcenterofgravityofcomputersecurity.Itiswheresecurityengineeringmeetscomputerscience.Itsfunctionistocontrolwhichprincipals(persons,processes,machines,.
3、..)haveaccesstowhichresourcesinthesystemwhichfilestheycanread,whichprogramstheycanexecute,howtheysharedatawithotherprincipals,andsoon.Accesscontrolworksatanumberoflevels(Figure4.1).ApplicationMiddlewareOperatingsystemHardwareFigure4.1:Accesscontrolsatdifferentlevelsinasystem9394Chapter4■Access
4、Control1.Theaccesscontrolmechanismstheuserseesattheapplicationlevelmayexpressaveryrichandcomplexsecuritypolicy.Amodernonlinebusi-nesscouldassignstafftooneofdozensofdifferentroles,eachofwhichcouldinitiatesomesubsetofseveralhundredpossibletransactionsinthesystem.Someofthese(suchasrefunds)mightr
5、equiredualcontrolorapprovalfromasupervisor.Andthatsnothingcomparedwiththecom-plexityoftheaccesscontrolsonamodernsocialnetworkingsite,whichwillhaveathicketofrulesandoptionsaboutwhocansee,copy,andsearchwhatdatafromwhom.2.Theapplicationsmaybewrittenontopofmiddleware,suchasadatabasemanagementsyst
6、emorbookkeepingpackage,whichenforcesanumberofprotectionproperties.Forexample,bookkeepingsoft-waremayensurethatatransactionwhichdebitsoneledgerforacertainamountmustcreditanotherledgerforthesameamount,whiledatabasesoftwaretypicallyhasaccesscontrolsspecifyingwhichdictio-nariesagivenusercanselect
7、,andwhichprocedurestheycanrun.3.Themiddlewarewillusefacilitiesprovidedbytheunderlyingoperatingsystem.Asthisconstructsresourcessuchasfilesandcommunicationsportsfromlowerlevelcomponents,itacquirestheresponsibilityforpro-vidingwaystocontrolaccess
