| 摘要 |
A method of providing access control to a database accessible from a user interface is implemented at a policy enforcement point, which is located between the database and the user interface and includes the steps of: (i) intercepting a database query; (ii) assigning attribute values on the basis of a target table or target column in the query, a construct type in the query, or the user or environment; (iii) partially evaluating an access-control policy defined in terms of said attributes, by constructing a partial policy decision request containing the attribute values assigned in step ii) and evaluating the access-control policy for this, whereby a simplified policy is obtained; (iv) deriving an access condition, for which the simplified policy permits access; and (v) amending the database query by imposing said access condition and transmitting the amended query to the database. |
| 主权项 |
1. A method of providing access control (AC) in respect of a database storing information and being accessible from a user interface, which is configured to accept a database query and return information extracted from the database,
the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and the user interface, and comprising: i) intercepting, at the PEP, a database query; ii) assigning attribute values by performing at least one of the following:
ii-a) assigning a resource attribute value based on at least one target table or target column appearing in the query;ii-b) assigning an action attribute value based on a construct type appearing in the query; andii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data; iii) providing an attributed-based AC policy defined in terms of said attributes; iv) deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned in step ii), evaluates to permit access; and v) amending the database query by imposing said access condition and vi) transmitting the amended query to the database. |
