TL;DR: Simple boolean role privilege models can be extracted and verified in linear time using the presented algorithms, while general approaches for inter-procedural model checking show a higher computational complexity due to their generality.
Abstract: Web based applications may suffer from role privilege violations duet vulnerabilities in the source code. This paper presents an original algorithm to extract simple boolean role privilege models from an inter-procedural perspective of PHP source code.Extracted models can be verified against role privilege violations,using model checkers. The proposed extraction approach has been preliminarily evaluated on a small PHP open source system, phpBB, that implements a bulletin board. Role privilege properties have been verified on the extracted models.Simple boolean security models can be extracted and verified in linear time using the presented algorithms, while general approaches for inter-procedural model checking show a higher computational complexity due to their generality. Results have been successfully compared with those previously obtained from the corresponding inter-procedural data-flow vulnerability analysis.Results and execution time performance of the proposed model extraction and of the validation processes are presented and discussed. Further research, possible extensions, and conclusions are reported.
TL;DR: In this paper, a privilege management system is applied to management of privilege of a user of at least one project platform, which comprises a registering module suitable to registering the user, role and privilege of the at least 1 project platform to the privilege management systems, a user management module which is suitable to acquire and store user basic information and user business demand information.
Abstract: The invention discloses a privilege management system and method. The privilege management system is applied to management of privilege of a user of at least one project platform. The privilege management system comprises a registering module suitable to registering the user, role and privilege of the at least one project platform to the privilege management system, a user management module suitable to acquire and store user basic information and user business demand information, a privilege distribution module suitable to distribute at least one privilege to each user according to the registered role and privilege to acquire a role privilege set, and a role distribution module suitable to distribute at least one role to each user according to the registered user and the role and to determine user role attribute information of the user according to the user business demand information. The user role attribute information comprises user role effective time information and/or user role available spatial information. Data processing speed can be improved and privilege management system can be optimized.
TL;DR: In this article, a cell phone privilege management and verification method based on a three-dimensional privilege level model is presented, which includes building roles and objects and operating on a 3D coordinate model, wherein values on coordinate axes are privilege levels.
Abstract: The invention discloses a cell phone privilege management and verification method based on a three-dimensional privilege level model, which includes: building roles and objects and operating on a three-dimensional coordinate model, wherein values on coordinate axes are privilege levels; building a sealed privilege area on the model according to demand analysis; setting role privilege levels on any program; setting object privilege levels on any datum; identifying corresponding values of any action request on three dimensions when any action request happens; and calculating an area where a coordinate formed by the three values is located and giving corresponding feedback. The cell phone privilege management and verification method based on the three-dimensional privilege level model has the advantages of being capable of performing more flexible, standard and efficient privilege management and verification on any program, and simultaneously leading safety to be better guaranteed through three-dimensional verification and the like.
TL;DR: Top-down collaborative modeling procedure is built via process model decomposition and a controlling mechanism based on role privilege is also applied to achieve logical separation between modeling user and access privilege.
Abstract: The characteristics of business process are analyzed, and a collaborative modeling method based on role privilege controlling is provided.Top-down collaborative modeling procedure is built via process model decomposition.A controlling mechanism based on role privilege is also applied to achieve logical separation between modeling user and access privilege.Update lock, freeze lock and four locking principles are introduced into the collaborative modeling mechanism.Simulation experimental results show this method is effective and feasible.
TL;DR: In this paper, a role privilege granting mechanism is established according to role privilege management, and the relationship between the user and the system function access is established through the roles; the process control step is to clearly prompt the relevant personnel needing to submit business according to the process when submitting business, and thus the business handling personnel can clear the handling direction of the business.
Abstract: An information system design method capable of meeting classified protection requirements includes data management, role privilege management and process control, wherein the data management process plans for the data storage modes, data types and contents, selects distributed storage for the data with larger number of video classes and higher security level, and carries out centralized storage to the structured data; a role privilege granting mechanism is established according to role privilege management, and the relationship between the user and the system function access is established through the roles; the process control step is to clearly prompt the relevant personnel needing to submit business according to the process when submitting business, and thus the business handling personnel can clear the handling direction of the business; during the business handling, the business submitter can check the business handling situation at any time, and can check the complete business flow chart, each node that is experienced during the business handling process, and the handling situation of each node; and business users can customize the specific contents for each class of processes.