• Annual Conference of KIPS
• /
• 2001.04a
• /
• pp.27-30
• /
• 2001

일반적인 운영체제의 보안과 마찬가지로 데이터베이스에서도 보안의 중요성은 강조되고 있다. 다중등급을 가지고 있는 데이터베이스에서 상위등급의 사용자가 사용하는 상위등급 데이터가 하위등급의 사용자가 사용하는 하위등급 데이터로 유입된다면 데이터의 무결성(integrity)이 깨지게 되어 데이터베이스뿐만 아니라 시스템 전체의 보안도 위협받게 된다. 본 연구에서는 대량의 데이터베이스 환경에서 다양한 보안등급을 가지고 있는 사용자가 다양한 등급을 가지고 있는 데이터베이스에 접근할 때 이를 강제적 접근제어(MAC:Mandatory Access Control)와 역할기반 접근제어(RBAC:Role-Based Access Control) 그래프를 이용해 사용자 보안등급에 따른 접근과 상위등급의 데이터가 하위등급으로 유출되지 않도록 이를 효율적으로 관리하고 제어할 수 있는 보안 모델을 제시하는데 중점을 두었다.

• The Journal of Information Technology
• /
• v.4 no.4
• /
• pp.15-24
• /
• 2001

In current role-based systems, security officers handle assignments of users to roles. This may increase management efforts in a distributed environment because of the continuous involvement from security officers. The role-based delegation provides a means for implementing RBAC in a distributed environment. The basic idea of a role-based delegation is that users themselves may delegate role authorities to other users to carry out some functions on behalf of the former. This paper presents a user-level delegation model, which is based on Extended Role-Based Access Control(ERBAC). ERBAC provides finer grained access control on the base of subject and object level than RBAC model.

• Journal of Korea Multimedia Society
• /
• v.8 no.2
• /
• pp.211-224
• /
• 2005

With the wide acceptance of the Internet and the Web, volumes of information and related users have increased and companies have become to need security mechanisms to effectively protect important information for business activities and security problems have become increasingly difficult. This paper proposes a improved access control model for access control enforcement in enterprise environments through the integration of the temporal constraint character of the GT-RBAC model and sub-role hierarchies concept. The proposed model, called Extended GT-RBAC(Extended Generalized Temporal Role Based Access Control) Model, supports characteristics of GTRBAC model such as of temporal constraint, various time-constrained cardinality, control now dependency and separation of duty constraints(SoDs). Also it supports unconditional inheritance based on the degree of inheritance and business characteristics by using sub-roles hierarchies in order to allow expressing access control policies at a finer granularity in corporate enterprise environments.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1998.12a
• /
• pp.495-507
• /
• 1998

개방형 통신환경에서 접근제어의 목적은 컴퓨팅 자원 및 통신 정보자원 등을 불법적인 사용자로부터의 사용, 노출, 수정, 파괴와 같은 비합법적인 행위로부터 보호하는데 있다. 본 논문에서는 상업적인 환경에서 조직의 관련된 작업을 기반으로 하는 역할기반정책에 주체와 객체에 등급을 부여하여 정보의 무결성을 보장하는 Biba 모델과의 연관성을 논하였다. 또한 인가등급을 갖는 주체를 역할그래프에 동적으로 배정할 수 있는 역할배정규칙과 제약조건을 정의하였으며 객체의 보안등급 비교유무에 따른 read-write 역할을 세분하여 그래프로 도식화하였다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.674-676
• /
• 2003

본 논문에서는 워크플로우 기술과 기업과 정부의 다양한 조직 체계를 반영하고 워크플로우의 현실적/효율적 운영관리 및 정보 보안을 위해 적합한 접근제어 모델인 역할기반 접근제어(RBAC : Role Based Access Control)를 이용한 워크플로우 보안 기술에 관하여 제안하였다. RBAC 기반 워크플로우 보안 기술은 워크플로우 시스템에 다양한 접근제어 서비스를 제공하기 위하여 서버/클라이언트 모델을 기반으로 하고 있으며, 이러한 워크플로우와 역할기반 접근제어 기술을 접목한 워크플로우 보안 기술은 기업 업무의 효율성을 증대 시키고 정보 보안 분야에 있어 정보 보안성 증대 및 정보보안정책을 구현하는데 유연성을 제공하는 새로운 기술로서의 역할을 수행한다.

• Annual Conference of KIPS
• /
• 2006.11a
• /
• pp.677-680
• /
• 2006

XML문서에 대한 보안요구가 커지면서 XML문서의 통신상 보안과 관리적 측면에서의 보안에 관련된 연구가 계속되고 있다. 이중 관리적 측면에서의 보안은 접근제어를 통해 제공할 수 있다. XML 문서에 대한 접근제어와 관련된 연구들은 XML 문서에 대한 일기 연산을 중심으로 연구되어왔다. 그러나 XML에 대한 연산은 읽기뿐만 아니라 추가, 삭제연산도 고려해야한다. 따라서 접근제어에서도 추가, 삭제 연산에 대한 연구가 필요하다. 본 논문에서는 추가, 삭제 읽기 연산간의 계층관계를 설정하고 이를 이용한 추가, 삭제 연산을 포함한 역할기반 XML 권한기술 모델을 제안하였다. 또한 권한기술 모델을 이용한 적용사례를 웹 포탈사이트 시나리오를 통해 제시하였다.

• The Transactions of the Korea Information Processing Society
• /
• v.4 no.9
• /
• pp.2354-2365
• /
• 1997

This paper presents a design of an access control mechanism that can resolves the complicated problems of access control requirements in modern information communication applications. In this paper, we proposed an integrated information model which can satisfy the combined goals of confidentiality, integrity and availability of any resource. We defined an integrated information model from the view points of identity-based, rule-based and role-based policy and implemented six access control operations. The proposed integrated information model can protect to unauthorized access to any resource based on the multilevel security policies of security label, integrity level, role and ownership.

• Journal of Convergence for Information Technology
• /
• v.10 no.10
• /
• pp.32-39
• /
• 2020

In the large-scale infrastructure of cloud environment, illegal access rights are frequently caused by sharing applications and devices, so in order to actively respond to such attacks, a strengthened access control system is required to prepare for each situation. We proposed an entity attribute-based access control(EABAC) model based on security level and relation concept. This model has enhanced access control characteristics that give integrity and confidentiality to subjects and objects, and can provide different services to the same role. It has flexibility in authority management by assigning roles and rights to contexts, which are relations and context related to services. In addition, we have shown application cases of this model in multi service environment such as university.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.8C
• /
• pp.1076-1085
• /
• 2004

Privacy enforcement has been one of the most important problems in IT area. Privacy protection can be achieved by enforcing privacy policies within an organization's data processing systems. Traditional security models are more or less inappropriate for enforcing basic privacy requirements, such as privacy binding. This paper proposes an extended role-based access control (RBAC) model for enforcing privacy policies within an organization. For providing privacy protection and context based access control, this model combines RBAC, Domain-Type Enforcement, and privacy policies Privacy policies are to assign privacy levels to user roles according to their tasks and to assign data privacy levels to data according to consented consumer privacy preferences recorded as data usage policies. For application of this model, small hospital model is considered.

• Journal of Digital Convergence
• /
• v.15 no.6
• /
• pp.219-227
• /
• 2017

Network access control should be able to effectively block security threats to the IT infrastructure, such as unauthorized access of unauthorized users and terminals, and illegal access of employees to internal servers. From this perspective, it is necessary to build metrics based on relevant standards to ensure that security is being met. Therefore, it is necessary to organize the method for security evaluation of NAC according to the related standards. Therefore, this study builds a model that combines the security evaluation part of ISO / IEC 15408 (CC: Common Criteria) and ISO 25000 series to develop security metric of network access control system. For this purpose, we analyzed the quality requirements of the network access control system and developed the convergence evaluation metric for security of the two international standards. It can be applied to standardization of evaluation method for network access control system in the future by constructing evaluation model of security quality level of network access control system.