基於屬性存取控制之應用程式介面安全框架研究;Research on Application Programming Interface Security Framework Based on Attribute-Based Access Control

NCU Institutional Repository > 管理學院 > 資訊管理學系碩士在職專班 > 博碩士論文 > Item 987654321/95524

jsp.display-item.identifier=請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/95524

题名:	基於屬性存取控制之應用程式介面安全框架研究;Research on Application Programming Interface Security Framework Based on Attribute-Based Access Control
作者:	陳怡雯;Chen, Yi-Wen
贡献者:	資訊管理學系在職專班
关键词:	應用程式介面安全;身份識別和存取管理;基於屬性的存取控制;零信任;最小權限原則;API Security;Identity and Access Management(IAM);Attribute-Based Access Control(ABAC);Zero Trust;Principle of Least Privilege
日期:	2024-07-25
上传时间:	2024-10-09 16:55:29 (UTC+8)
出版者:	國立中央大學
摘要:	隨著科技的快速發展，API(應用程式介面)已成為數位轉型的關鍵技術之一。API提高了系統間便利性、促進系統整合與創新合作。然而，伴隨著API使用的爆炸性增長，安全風險顯著上升，尤其是身份驗證與授權相關的問題。為了應對API面臨的安全威脅，各界提出了API框架的概念。歐盟在2020年提出了一個適用於政府環境的API框架，包含12項實施建議。然而，該框架在身份識別和存取管理(IAM)方面的指引尚有不足。在零信任安概念的潮流下，身份已成為新的安全邊界，可以通過IAM機制來強化身份認證和細粒度存取控制，貫徹最小權限原則。本研究旨在探討並改善歐盟提出的API框架，將基於屬性的存取控制(ABAC)和零信任的概念整合到安全流程中，提出一個基於ABAC的API安全框架，提高API在動態和複雜環境中的靈活性和安全性，通過動態評估使用者、資源和環境的屬性來決定存取權限，提供更細粒度和情境相關的安全控制能力。這一框架讓API設計和開發人員在制定和設計API時有明確的參考依據，從而提高API的安全。本研究期望能為API安全領域提供新的視角和實踐框架，助力組織在實現數位轉型的同時，有效保護API及相關資源免受安全威脅，協助組織向零信任安全邁進。 ;With the rapid advancement of technology, APIs (Application Programming Interfaces) have become crucial for digital transformation. APIs enhance system convenience, integration, and innovation. However, their explosive growth has significantly increased security risks, especially in authentication and authorization. To address API security threats, various frameworks have been proposed. In 2020, the EU introduced an API framework for government environments with 12 implementation recommendations. However, it lacks sufficient guidance in identity and access management (IAM). With the rise of zero trust security, identity is the new security perimeter. Strengthening identity authentication and fine-grained access control through IAM mechanisms enforces the principle of least privilege. This study aims to improve the EU′s API framework by integrating attribute-based access control (ABAC) and zero trust concepts. It proposes an ABAC-based API security framework to enhance flexibility and security in dynamic environments. By evaluating user, resource, and environment attributes dynamically to determine access permissions, it offers more fine-grained, context-related security controls. This framework provides clear guidelines for API designers and developers, improving API security. The study aims to offer a new perspective and practical framework for API security, helping organizations achieve digital transformation while protecting APIs and related resources from security threats, and advancing towards zero trust security.
显示于类别:	[資訊管理學系碩士在職專班 ] 博碩士論文

文件中的档案:

档案	描述	大小	格式	浏览次数
index.html		0Kb	HTML	25	检视/开启

在NCUIR中所有的数据项都受到原著作权保护.

社群 sharing

数据加载中.....