A SaaS Resource Authorization Management Model based on Resource Directed Tree

Access control of SaaS platform is a key security issue to solve. Several access control models have been proposed, but most of the existing models could not provide flexible, fine-grained access control in SaaS. The H-RBAC model which inherits the flexibility of the RBAC model cannot balance fine-grained permission assignment and effective control of the complexity of authorization management. This paper proposes a SaaS resource authorization management model based on resource directed tree, which is improved based on the H-RBAC model. In this model, the resource directed trees in which the resources of SaaS platform are organized by business logic, are introduced between roles and resources in the HRBAC model, and the role permissions are assigned based on the directed tree to reduce the workload of authorization management. At the same time, based on the resource directed tree, an attribute-based permission reduction method which combines the ABAC and RBAC is introduced. It not only effectively controls the workload of authorization management, but also ensures that session permissions are constrained fine-grained and dynamically.