Managing Multi-dimensional Multi-granular Security Policies Using Data Warehousing

Over the last several years, sophisticated access control models have been proposed to take into account different dimensions such as time, space, role, context, attribute, etc. These enable specification of fine grained access control policies that can better express evolving organizational needs. However, there is no comprehensive solution that can uniformly specify, evaluate, maintain and analyze this multitude of policies in a consistent fashion. In this paper, we show that specifying and enforcing access control policies of multiple granularities and dimensions can be transformed into the problem of storing and querying data at multiple granularities and dimensions. Specifically, we develop a unified schema to represent several standard access control policies and show how they can be automatically evaluated. We have implemented the system in Oracle, and evaluated its scalability.

在过去几年中，人们提出了复杂的访问控制模型，以考虑不同维度，如时间、空间、角色、情境、属性等。这些模型能够详细规定访问控制策略，从而更好地表达不断变化的组织需求。然而，目前还没有一个全面的解决方案，能够以一致的方式统一规定、评估、维护和分析如此众多的策略。在本文中，我们表明，规定和执行多粒度和多维度的访问控制策略可以转化为多粒度和多维度的数据存储和查询问题。具体而言，我们开发了一个统一的模式来表示几种标准的访问控制策略，并展示了如何自动对其进行评估。我们已在甲骨文数据库中实现了该系统，并对其可扩展性进行了评估。