A Comprehensive Security Policy Research on Web Information System

被引：0
|
作者：
Wang, Fengying [1 ]
Li, Caihong [1 ]
Zhao, Lei [1 ]
Li, Xiumei [1 ]
机构：
[1] Shandong Univ Technol, Sch Comp Sci & Technol, Zibo 255049, Shandong, Peoples R China
来源：
2009 IEEE INTERNATIONAL CONFERENCE ON AUTOMATION AND LOGISTICS ( ICAL 2009), VOLS 1-3 | 2009年
关键词：
single-sign-on; cross-domain access; identity authentication; system audit; trust management;
D O I：
10.1109/ICAL.2009.5262671
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
In order to solve security problems in web-based information systems in the large-scale distributed environment, we design a comprehensive security policy. We realize the single entry mechanism of multi-system access by using the single-sign-on, create identity authentication mechanism of high-reliability and security based on China's second-generation ID card. We also propose the cross-domain setup and its strategies for the access from scattered information systems. This paper will show the access control policy which combines dynamic and static methods, bring up a combination of coarse-grained and fine-grained access control strategy through refining digital objects, operations and rights. Besides we realize encrypted data communication for VPN by using SSL encryption technology to make data encapsulation. Considering the database security, we adopt access control technology, separation control technology, encryption technology, data flow control technology, reasoning control technology and backup technology. We then track and check all users who accessed or tried to access the system by using the system audit, use the triple-right separation mechanism for reliable management to avoid the abuse of powerful rights owned by the system administrator.
引用
收藏
页码：1776 / 1780
页数：5
相关论文
共 50 条
  • [1] Security Policy on Logistics Management Information System Based on Web
    Huang, Linna
    Liu, Fenghua
    [J]. PROCEEDINGS OF THE 2ND INTERNATIONAL CONFERENCE ON COMPUTER AND INFORMATION APPLICATIONS (ICCIA 2012), 2012, : 1211 - 1214
  • [2] The Formulation of Comprehensive Information Security Culture Dimensions for Information Security Policy Compliance Study
    Nasir, Akhyari
    Arshah, Ruzaini Abdullah
    Ab Hamid, Mohd Rashid
    [J]. ADVANCED SCIENCE LETTERS, 2018, 24 (10) : 7690 - 7695
  • [3] Comprehensive analysis of the security risk of information system
    Song, Rushun
    [J]. Jisuanji Gongcheng/Computer Engineering, 2000, 26 (12): : 33 - 34
  • [4] Automatic Defensive Security System for WEB Information
    Huo, Jiuyuan
    Qu, Hong
    [J]. ADVANCED INFORMATION TECHNOLOGY IN EDUCATION, 2012, 126 : 83 - 88
  • [5] Research on information system security models
    Li, Shou-Peng
    Sun, Hong-Bo
    [J]. Tien Tzu Hsueh Pao/Acta Electronica Sinica, 2003, 31 (10): : 1491 - 1495
  • [6] Research on information security model and security system design
    Huang, Yi-Min
    Ping, Ling-Di
    Pan, Xue-Zeng
    [J]. Zhejiang Daxue Xuebao (Gongxue Ban)/Journal of Zhejiang University (Engineering Science), 2001, 35 (06): : 603 - 607
  • [7] A policy-based security model for web system
    Xie, WX
    Ma, HD
    [J]. 2003 INTERNATIONAL CONFERENCE ON COMMUNICATION TECHNOLOGY, VOL 1 AND 2, PROCEEDINGS, 2003, : 187 - 191
  • [8] Implementation of an Information Systems Security Policy: Action Research
    Lopes, Isabel
    Oliveira, Pedro
    [J]. PROCEEDINGS OF THE 13TH EUROPEAN CONFERENCE ON RESEARCH METHODOLOGY FOR BUSINESS AND MANAGEMENT STUDIES (ECRM 2014), 2014, : 244 - 252
  • [9] Research and Implementation of Security Policy of Library Digital Information
    Wang Haixia
    [J]. PROCEEDINGS OF THE 2013 INTERNATIONAL CONFERENCE ON ADVANCES IN SOCIAL SCIENCE, HUMANITIES, AND MANAGEMENT, 2013, 43 : 565 - 571
  • [10] Retrofitting security into a Web-based information system
    da Cruz, DB
    Rumpe, B
    Wimmel, G
    [J]. WEB ENGINEERING, PROCEEDINGS, 2003, 2722 : 301 - 305
12345