Research and implementation on access control of management-type SaaS

Abstract

In the paper, we analyze the features of access control of management-type SaaS. Based on the traditional RBAC, we put forward the access control model based on both tenant and role, in which the tenant is as the minimum unit of administrative domain. To be sure user identity with physical security, we put forward the hierarchical authentication and management of user in the management-type SaaS. In order to ensure the access control model of management-type SaaS in line with the reality, we abolish the inheritance right of role in the traditional RBAC. Based on the timing diagram of UML, analyzing the access control model of the cattle public administration platform based on the SaaS, we present its dynamic modeling of access control. Test and analysis is shown that the access control model based on both tenant and role can ensure the accessibility, security and privacy to access cross-domain in the management-type SaaS, and promote the popularization and application of the management-type SaaS.

基于租户的访问控制模型T-ARBAC<br>A Tenant-Based Access Control Model T-Arbac

“…自主访问控制(DAC) [2] 、强制访问控制(MAC) [3] 、基于 角色的访问控制(RBAC) [4] 。但对于 SaaS 模式来说， 不管是安全性还是可管理性，已有的访问控制方法都 不能够很好地适用,所以需要根据 SaaS 模型的特点提 出新的访问控制模型。目前，国内外学者对此问题已 经做出了相关研究，Jing Xu 等人通过禁用 RBAC 模 型角色间的继承关系来防止角色间的权限继承，从而 防止权限扩散的危险，达到安全的访问控制 [5] 。Yuri …”

TOSSMA: A Tenant-Oriented SaaS Security Management Architecture

“…Xu et al [9] propose a new hierarchical access control model for the SaaS model. Their model adds higher levels to the access control policy hierarchy to be able to capture new roles such as service providers' administrators (super and regional) and tenants' administrators.…”

Research on Web Service-Oriented Access Control Model

“…Literature [5] adopted a layered approach and proposed an access control method for SaaS platform on the basis of RBAC. Literature [6] also proposed an access control method for SaaS platform; this method disabled the role of inheritance and showed the user the accessing processes by UML diagram, but roles and tenants were in a multi-to-multi relationship and they might easily suffer from conflicts. A multi-tenant access control model was introduced in literature [7], but could not achieve role inheritance on the level of tenant.…”