基于DIFC的租户自主授权SaaS层数据隔离与共享模型  

Self-authorized isolation and sharing data model on SaaS based on DIFC

作　　者：曾萍[1,2] 路宇 鞠磊 胡荣磊[1] 

机构地区：[1]北京电子科技学院,北京100070 [2]西安电子科技大学通信工程学院,西安710071

出　　处：《计算机应用研究》2017年第11期3455-3458,共4页Application Research of Computers

基　　金：北京市自然科学基金资助项目(4163076);北京电子科技学院中央高校基本科研业务费资助项目(328201502)

摘　　要：Saa S服务提供者对租户间提供数据共享服务时,容易造成租户数据的泄露,并且在租户未经许可的情况下,可以非法获取租户的隐私数据。针对上述Saa S服务的缺陷,引入了分布式信息流控制(DIFC)安全防护机制,提出了基于DIFC的租户自主授权Saa S层数据隔离与共享模型。该模型强制Saa S服务提供者执行标签比对机制,各租户可以自主划分用户信息级别,定制全球唯一标记。通过第三方可信标签管理授权服务(AS),细粒度地限制租户间的数据共享操作,并必须经用户授权标签才能访问相应数据。最终证明了此模型可以满足租户数据隔离与共享的安全。It is easy to cause the tenant＇ s data leakage, when SaaS server provides data sharing service among tenants. Without the tenant＇ s permission, the SaaS server also can acquire the tenant＇ s privacy data illegally. To solve the above defects, this paper introduced the DIFC mechanism, and proposed an isolation and sharing data model based on DIFC in the level of tenants. This model enforced SaaS server provider perform tag comparison mechanism. Every tenant could divide the level of user information autonomously and customize global unique identification. The users could fine-grained control data sharing operation through a third AS. Meanwhile, programs must be authorized tag by user before accessed the according data. Finally, this paper proves that this model can satisfy the security requirements of tenant＇ s isolating and sharing data.

关 键 词：分布式信息流控制 软件即服务 第三方可信标签 授权服务 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]