一种基于角色等级树的SaaS多租户多域访问控制模型  

A SAAS MULTI-TENANT MULTI-DOMAIN ACCESS CONTROL MODEL BASED ON ROLE-LEVEL TREE

作　　者：熊光辉 白尚旺[1] 党伟超[1] 潘理虎[1] 张睿 Xiong Guanghui;Bai Shangwang;Dang Weichao;Pan Lihu;Zhang Rui(School of Computer Science and Technology, Taiyuan University of Science and Technology, Taiyuan 030024, Shanxi, China)

机构地区：[1]太原科技大学计算机科学与技术学院,山西太原030024

出　　处：《计算机应用与软件》2018年第6期313-318,333,共7页Computer Applications and Software

基　　金：山西省重点研发计划(一般)工业项目(201703D121042-1)

摘　　要：基于角色的访问控制模型RBAC(Role-Based Access Control)能够适用于软件即服务多租户SaaS(Software-as-a-Service)模式应用单租户域安全访问环境。在RBAC模型中通过角色映射实现多租户域访问可能产生最小权限、职责分离问题从而使得租户数据不安全。在RBAC模型的基础上针对SaaS多租户模式给出一种基于角色等级树的多租户多域安全互操作的访问控制方法,利用角色等级树映射和冲突检测消除策略以期解决角色映射冲突。通过原型系统实验验证了模型能够在保留RBAC模型易于授权、角色分层管理等优点的情况下,结合角色等级树解决了RBAC模型多租户域角色映射时引起的SaaS多租户间的上述冲突问题。The role-based access control model（ RBAC） can be applied to the software-as-a-service（ SaaS） model to apply a single tenant domain security access environment. Multi-tenant domain access through role mapping in the RBAC model may result in least privilege and separation of duties,making tenant data insecure. Based on RBAC model,this paper presented a multi-tenant multi-domain security interoperability access control method based on role hierarchy tree for SaaS multi-tenant model. It used role-level tree mapping and conflict detection elimination strategies to resolve role mapping conflicts. Through prototype system experiments,it was verified that the model solved the above conflict between SaaS multi-tenant caused by RBAC model multi-tenant domain role mapping,while retaining the advantages of RBAC model easy authorization and role hierarchical management.

关 键 词：SaaS多租户 多域 RBAC模型 角色等级树 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]