基于功能的访问控制（FBAC）：从访问控制矩阵到访问控制张量
Function-Based Access Control (FBAC): From Access Control Matrix to Access Control Tensor
摘要：
安全研究人员指出，当前访问控制实现背后的核心概念早于互联网。提出这些主张是为了指出这一领域存在基础性差距，人们应该考虑从头开始重新审视这些概念。此外，内部威胁，这是一个越来越多的威胁向量对组织也与访问控制的失败。从访问控制矩阵中导出的访问控制模型包含主体、对象和操作三组实体。通常，对象被认为是文件，操作被认为是读、写和执行。这意味着在授予数据访问权限时采取“芝麻开门”的办法，即一旦授予访问权限，就不限制命令的执行。受功能加密的启发，我们建议以更细的粒度应用访问授权，但不是临时或计算上难以加密的方法，我们假设访问控制的基本转换。从抽象的角度来看，我们建议将访问授权存储为三维张量，我们称之为访问控制张量（ACT）。在基于功能的访问控制（FBAC）中，应用程序不给予盲折叠执行权限，只能调用已被授权的数据段的命令。换句话说，一个人可能被授权在一个对象上使用某个命令，而被禁止在另一个对象上使用完全相同的命令。本文介绍了FBAC的理论基础及其在政策、实施和实施（PEI）方面的要求，并重点分析了部署FBAC的优势、它将如何导致开发新一代应用程序以及与现有模型和系统的兼容性。最后给出了FBAC的概念验证实现。
英文摘要：
Security researchers have stated that the core concept behind current implementations of access control predates the Internet. These assertions are made to pinpoint that there is a foundational gap in this field, and one should consider revisiting the concepts from the ground up. Moreover, Insider threats, which are an increasing threat vector against organizations are also associated with the failure of access control. Access control models derived from access control matrix encompass three sets of entities, Subjects, Objects and Operations. Typically, objects are considered to be files and operations are regarded as Read, Write, and Execute. This implies an `open sesame' approach when granting access to data, i.e. once access is granted, there is no restriction on command executions. Inspired by Functional Encryption, we propose applying access authorizations at a much finer granularity, but instead of an ad-hoc or computationally hard cryptographic approach, we postulate a foundational transformation to access control. From an abstract viewpoint, we suggest storing access authorizations as a three-dimensional tensor, which we call Access Control Tensor (ACT). In Function-based Access Control (FBAC), applications do not give blind folded execution right and can only invoke commands that have been authorized for data segments. In other words, one might be authorized to use a certain command on one object, while being forbidden to use exactly the same command on another object. The theoretical foundations of FBAC are presented along with Policy, Enforcement and Implementation (PEI) requirements of it. A critical analysis of the advantages of deploying FBAC, how it will result in developing a new generation of applications, and compatibility with existing models and systems is also included. Finally, a proof of concept implementation of FBAC is presented.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
