Modelo para controle de acessos baseado em função utilizando segurança em nível de linha

Abstract

Fine-grained access control is an open problem, for which there are few studies that solve it based on a single method. In a corporative environment, information technology is a strategic resource that contributes for survival and permanence of corporations in business, causing these corporations to use softwares that have not only the centralization of data and information as an objective, but also the easing of administrative and organizational processes. Knowing this, it’s understandable that those organizations care that their computational environment is as safe as possible, since protecting data against unauthorized access is of the utmost importance: studies show that a considerable portion of attacks are conducted by individuals that already had access to the system, which proves that neglecting to control data access, allowing improper access, can cause alteration or destruction of important information. This work intends to propose the implementation of a framework that joins Role-Based Access Control (RBAC) to the Row Level Security that is already present by some database management systems. This implementation allows for information accessed or written by application users to be controlled directly in the database, which in turn makes it easier to guarantee that writings and readings of each entry is controlled, both in general and specific ways. This model defines a structure used to implement security policies attached directly to database objects, making the existence of access rules that limit the info available to each user possible. In addition, this procedure contributes to the transparency and organizational visibility related to data access, since every procedure, rule and role responsible for each instance is explicitly defined and easily managed. Finally, this model reduces considerably the manual writing of code destined to data access control, allowing for an easier upkeep and organization of the system as a whole.