DonNTU   Masters' portal

Petr Zimtsev

Faculty of computer science and technology (CST)

Department of computer engineering (CE)

Speciality Software of computer equipment

The study of ways to separate user access to web-resources

Scientific adviser: Ph.D., Olga Cherednikova

Resume Abstract

Abstract

Content

• Introduction
• 1. Theme urgency
• 2. The study of ways to separate user access to web-resources
• 2.1 ACL Access Sharing Model
• 2.2 RBAC Access Sharing Model
• 3. Implementation of separate access module based on the RBAC model
• 3.1 Algorithm of microservice authorization functioning
• 3.2 Improving the RBAC model for allocating access rights
• 4. Implementing an improved model in Go
• Conclusion
• References

Introduction

With the development of technology and the emergence of the ability to store data on separate elements and to have access to process them in the modern world, a person has the task of sharing access. At the moment, technology is quite deeply embedded in the daily life of man. The more human life is simplified, the greater the complexity of the technology.

1. Theme urgency

Web resources are the most common way to share information. These resources are used in very many areas, which has led to the development of network technologies and the emergence of corporate networks. However, the main problem appeared - the distribution of user data access. According to the different laws of privacy, each user must have access to the data that is necessary to perform his duties. This privacy policy is used by many businesses. Also, the distribution of access affects the heath data. The more accurate the rules will be described. the more flexible access can be given to the user.

2. The study of ways to separate user access to web-resources

Access research is not the most “young” topic, but it is the most interesting and useful topic based on the principles that the separation of data should clearly describe the user's rights. be flexible and not allow unauthorized access to the information that should be inaccessible and not be useful for the user in terms of the workflow. Information should always be available to the user for the productive execution of the workflow. There are different access models built on different principles and widely used. Different models are similar to each other in that they inherit certain logical principles of functioning. One of the most popular models is selected for consideration - these are ACL and RBAC.

Main tasks of the research:

1. Access distribution analysis using the ACL model.
2. Access distribution analysis using the RBAC model.
3. Implementing a separate module access using the RBAC model.
4. Implementing an improved model in Go.

Research object: RBAC access distribution model.

Research subject: research and implementation of improved RBAC model flexibility.

As part of the master's work, it is planned to receive topical scientific resultsin the following areas:

1. Distribution of the user accessibility.
2. Explore popular access patterns.
3. Modification of one of the access distribution model.

For the experimental evaluation of the theoretical results obtained and the formation of the foundation for further research, as practical results it is planned development of microservice using the Go programming language from Google based on the proposed modifications with the following properties:

1. Log in using Go.
2. Implementation of modification of the distributed access model.

2.1 ACL Access Sharing Model

Access Control List or ACL is an access control list that determines who or what can access an object (program, process, or file), and which operations are allowed or forbidden for the subject (user, group of users) to perform. File systems use a process user identifier (UID in POSIX terms) to implement ACLs.

An access list is a data structure that contains records that define the rights of an individual user or group to special system objects, such as programs, processes, or files. These records are also known as ACE (Access Control Entries) in Microsoft Windows and OpenVMS. In Linux and Mac OS X, most file systems have extended attributes that act as an ACL. Each object in the system contains a pointer to its own ACL. Privileges (or privileges) define special permissions that allow a user to read from, write to, or execute an object. In some implementations, ACE (Access Control Entries) may define the right of a user or group to modify an object's ACL.

ACL concepts vary across operating systems, despite the existing POSIX “standard” [6]. (The POSIX security projects, .1e and .2c, were recalled when it became clear that they affected a very large area and the work could not be completed, but the well-defined parts that define ACLs were widely implemented and are known as "POSIX ACLs.")

In networks, ACLs represent a list of rules defining service ports or domain names available on a node or another OSI Layer 3 device, each with a list of nodes and / or networks that are allowed to access the service. Network ACLs can be configured on both a regular server and a router and can control both incoming and outgoing traffic as a firewall.

2.2 RBAC Access Sharing Model

Role-based access control - the development of selective access control policies, while the access rights of the subjects of the system to objects are grouped according to the specifics of their application, forming roles.

The formation of roles is designed to define clear and understandable for users of the computer system access control rules. Role access control allows you to implement flexible, changing dynamically in the process of functioning of a computer system, access control rules.

This access demarcation is a component of many modern computer systems. As a rule, this approach is used in DBMS protection systems, and individual elements are implemented in network operating systems. Role-based approach is often used in systems for users of which the range of their official powers and duties is clearly defined.

Despite the fact that the Role is a set of access rights to objects of a computer system, role-based access control is not a special case of selective access control, since its rules determine the procedure for granting access to computer system subjects depending on the existing (or missing) roles in its every moment of time, which is characteristic of mandatory access control systems. On the other hand, the rules of role-based access control are more flexible than with the mandatory approach to differentiation [5].

Since privileges are not assigned to users directly and are acquired by them only through their role (or roles), the management of the individual rights of the user in essence boils down to the assignment of roles to him. This simplifies operations such as adding a user or changing a unit by a user.

3. Implementation of separate access module based on the RBAC model

At the moment, the most popular model is the role-based access distribution model. Adding a role to each user contributes to a clearer and more flexible distribution of roles in the system that uses this implementation. The RBAC model is very often used in web resources, making it easy to define data access for a user based on a given role[3].

3.1 Algorithm of microservice authorization functioning

The algorithm of functioning of microservice authorization is based on URL requests and the request processing functions described inside microservice. In modern web resources, the authorization process is a rather complicated technology, since many difficulties are reduced to the main point of authorization - the security of personal data and resource data. Vazhnoy chast'yu yavlyayetsya prepyatstvovaniye vnedreniya virusnykh programm ili raznykh chastey vredonosnogo programmnogo koda, kotoryy posle vstraivaniya v sistemu privodit k utechke personal'nykh dannykh, a poskol'zu pri dal'neyshey rabote s veb-resursom vredonosnoye PO mozhet nanesti ser'yeznyy ushcherb dlya vsego resursa, kak dlya chasti kliyenta, tak i dlya servernoy chasti, v kotoroy zachatuyu vypolnyayetsya obrabotka opredelennyy dannyy kotoryye libo prishli v URL-zaprose, libo dolzhny obrabotat'sya programmno i vernut' na chast' kliyenta opredelennuyu zaproshennuyu informatsiyu, kotoraya ponimayetsya kak servernyy otvet na kliyentskiy zapros. An important part is to prevent the introduction of virus programs or different parts of malicious program code, which, after being embedded in the system, leads to leakage of personal data, and further work with a web resource, malware can cause serious damage to the entire resource, both for a part of the client and for and for the server part, in which the conception is performed, the processing of a certain data that either came in the URL request, or must be processed programmatically and return to the part of the client certain requested information a format that is understood as a server response to a client request. Microservices are created to solve this problem. They should be easily integrated into web resources and perform not only fast processing of a small part of information, but also adhere to the universality as much as possible, as well as have good protection in order to provide a high level of viral stability and personal data safety[4].

3.2 Improving the RBAC model for allocating access rights

Before improving anything, it is necessary to analyze the object of study, identify the advantages and disadvantages of the object under study, develop and implement improvements. At the time of writing the essay, namely, January 2019, various models of access separation were investigated and the RBAC model was chosen the most optimal and popular. However, with some example you can notice some of her problems[2]. The model itself implements the principle of access to data by user role and is presented in Figure 1.