OpenMRS中基于身份验证的访问控制
Relationship-Based Access Control for OpenMRS
摘要：
受社会网络系统访问控制模型的启发，最近提出了一种基于授权的访问控制（ReBAC），它是一种通用的应用领域访问控制范例，在这种应用领域中，授权必须考虑访问请求者和资源所有者之间的关系。医疗保健领域被设想为其中迫切需要ReBAC的典型应用领域：例如，我的病历应该只有我的家庭医生才能看到，而不是所有的医生都能看到。在这项工作中，我们首次证明了ReBAC可以被纳入到一个生产规模的医疗记录系统，OpenMRS，与传统的RBAC机制向后兼容。具体来说，我们扩展了OpenMRS的访问控制机制，以执行ReBAC策略。我们的扩展包含并扩展了Crampton和Sellwood最近提出的高级ReBAC功能。此外，我们设计并实现了ReBAC的第一个管理模型。在本文中，我们描述了我们的ReBAC实施，讨论了系统工程的经验教训，因此，并评估我们所进行的实验工作。特别是，我们比较了我们实现的各种授权方案的性能，从而证明了ReBAC的可行性。
英文摘要：
Inspired by the access control models of social network systems, Relationship-Based Access Control (ReBAC) was recently proposed as a general-purpose access control paradigm for application domains in which authorization must take into account the relationship between the access requestor and the resource owner. The healthcare domain is envisioned to be an archetypical application domain in which ReBAC is sorely needed: e.g., my patient record should be accessible only by my family doctor, but not by all doctors. In this work, we demonstrate for the first time that ReBAC can be incorporated into a production-scale medical records system, OpenMRS, with backward compatibility to the legacy RBAC mechanism. Specifically, we extend the access control mechanism of OpenMRS to enforce ReBAC policies. Our extensions incorporate and extend advanced ReBAC features recently proposed by Crampton and Sellwood. In addition, we designed and implemented the first administrative model for ReBAC. In this paper, we describe our ReBAC implementation, discuss the system engineering lessons learnt as a result, and evaluate the experimental work we have undertaken. In particular, we compare the performance of the various authorization schemes we implemented, thereby demonstrating the feasibility of ReBAC.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
