XACML与NGAC：基于ABAC的NIST SP 800-178数据服务应用权限控制比较

需积分: 10 183 浏览量更新于2024-07-16 收藏 1.47MB PDF 举报

NIST SP800-178, 题为《NIST SP800-178：数据服务应用中的属性基访问控制（ABAC）标准比较——XACML与NGAC》，是由David Ferraiolo、Ramaswamy Chandramouli、Vincent Hu和Rick Kuhn共同编写的。该文档旨在对比和分析两个不同的访问控制标准：Extensible Access Control Markup Language (XACML) 和 Next Generation Access Control (NGAC)，这两个标准虽然目标相似，但在实现和应用上存在显著差异。 XACML (eXtensible Access Control Markup Language) 是一个广泛使用的标准化框架，它基于XML（可扩展标记语言），用于表达和处理访问控制策略。XACML采用声明式方法，通过定义规则来确定用户或系统是否具备执行特定操作的权限，这些规则通常基于用户属性（如角色、身份、位置等）。它适用于复杂的访问控制场景，支持多种业务逻辑和策略组合，是企业级安全管理和合规性需求的首选。相反，Next Generation Access Control (NGAC) 是一个相对较新的概念，它代表着下一代访问控制的发展趋势，可能包括更先进的技术，如云计算、大数据分析和人工智能在访问控制决策中的应用。NGAC可能更加灵活和动态，强调适应性和自适应策略，可能侧重于实时响应和行为分析，而不是仅仅依赖于预定义的属性。 NIST SP800-178通过参考NIST SP 800-162《属性基访问控制（ABAC）定义和考虑因素》指南，对这两种标准进行了深入的分析，着重于ABAC（Attribute-Based Access Control）的概念，即基于个体属性和环境上下文来决定授权的策略。该文档不仅提供了两种标准的基本介绍，还对它们在ABAC实施上的优缺点、适用场景和未来发展方向进行了比较。该出版物是免费提供给公众的，可以从NIST官方网站获取，链接为<http://dx.doi.org/10.6028/NIST.SP.800-178>。这份文档对于理解和评估企业在选择ABAC标准时的选项具有重要意义，特别是对于那些处理敏感数据和服务应用的组织，了解不同标准如何满足不断增长的网络安全需求至关重要。同时，它也反映了NIST作为国家标准制定机构，在推动信息安全技术演进和最佳实践方面的角色。

NIST SP 800-178 COMPARISON OF ABAC STANDARDS FOR

ATA SERVICES: XACML AND NGAC

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

List of Tables

Table 1. Attribute Names and Values and the Authorization State for Policy 1 ............. 12

Table 2: Derived Privileges for the Independent Configuration of Figures 6a and 6b ... 25

Table 3: Derived Privileges for the Combined Configuration of Figures 6a and 6b ....... 26

Table 4: Derived Privileges for the Configuration of Figure 8 ........................................ 27

NIST SP 800-178 COMPARISON OF ABAC STANDARDS FOR

ATA SERVICES: XACML AND NGAC

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

1 Introduction

1.1 Purpose and Scope

The purpose of this document is to compare and contrast Extensible Access Control Markup

Language (XACML) and Next Generation Access Control (NGAC) — two very different access

control standards with similar goals and objectives. The document explains the basics of both

standards and provides a comparative analysis based on attribute based access control (ABAC)

considerations identified in NIST Special Publication (SP) 800-162, Guide to Attribute Based

Access Control (ABAC) Definition and Considerations [2].

1.2 Audience

The intended audience for this document includes the following categories of individuals:

• Computer security researchers interested in access control and authorization frameworks;

• Security professionals, including security officers, security administrators, auditors, and

others with responsibility for information technology (IT) security;

• Executives and technology officers involved in decisions about IT security products; and

• IT program managers concerned with security measures for computing environments.

This document, while technical in nature, provides background information and examples to help

readers understand the topics that are covered. The material presumes that readers have a basic

understanding of security and possess fundamental access control expertise.

1.3 Document Structure

The remainder of this document is organized into the following sections:

• Section 2 provides background information on the origins, makeup, and objectives of

XACML and NGAC.

• Section 3 describes XACML’s policy specification language and reference architecture

for ABAC implementation.

• Section 4 describes NGAC’s fundamentally different approach from XACML for

representing requests, expressing and administering policies, representing and

administering attributes, and computing and enforcing decisions.

• Section 5 provides an analysis of XACML and NGAC’s similarities and differences

based on five criteria.

• Section 6 contains the conclusion for the document.

• Appendix A— provides a list of acronyms used in the document.

• Appendix B— contains a list of references.

• Appendix C— provides a formal XACML policy specification for an abbreviated policy

example in Section 3.

NIST SP 800-178 COMPARISON OF ABAC STANDARDS FOR

ATA SERVICES: XACML AND NGAC

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

2 Background

Controlling and managing access to sensitive data has been an ongoing challenge for decades.

Attribute-based access control (ABAC) represents the latest milestone in the evolution of logical

access control methods. It provides an attribute-based approach to accommodate a wide breadth

of access control policies and simplify access control management.

Most other access control approaches are based on the identity of a user requesting performance

of an operation on a resource (e.g., read a file), with the capability enabled directly based on the

user’s identity, or indirectly through predefined attribute types such as roles or groups assigned

to the user. Practitioners have noted that these forms of access control are often cumbersome to

set up and manage, given their need to associate capabilities directly to users or their attributes,

and the difficulty of doing so. Furthermore, the identity, group, and role qualifiers of a requesting

user are often insufficient for expressing real-world access control policies. An alternative is to

express policies in terms of attributes and to grant or deny user requests based on arbitrary

attributes of users and resources, and optionally environmental attributes. This approach to

access control is commonly referred to as attribute-based access control (ABAC) and is an

inherent feature of both XACML and NGAC.

The access control logic of an ABAC engine that computes decisions based on assigned

attributes of a requesting user, resource, and environment, and policies expressed in terms of

those attributes is depicted in Figure 1.

Figure 1: ABAC Overview

There are two techniques for specifying ABAC policies [6]. The most common approach is to

define authorization policies by using logical formulas involving predicates expressed using

logical operations (e.g., AND, OR, ≥, ≠) on attribute values. For example, can_access (u, a, o) →

剩余67页未读，继续阅读

艾米的爸爸

粉丝: 787
资源: 314

XACML与NGAC：基于ABAC的NIST SP 800-178数据服务应用权限控制比较

ngac:下一代访问控制

NIST零信任架构SP 800-207 标准草案（中文版）.pdf

NIST SP800-20.pdf

NIST SP800-51.pdf

NIST SP800-125.pdf

NIST SP800-133.pdf

NIST SP800-36.pdf

NIST SP800-111.pdf

NIST SP800-170.pdf

NIST SP800-37.pdf

最新资源