臺灣博碩士論文加值系統

組織內部總是會有複數系統的存在，它們各自有其專門負責的領域，但是也因為彼此之間負責的領域相異，導致異質性系統的權限管理變得鬆散與困難。在此前提之下，如何設計跨系統權限管理平台，使其能夠控管動態權限，讓異質系統在整合時可以不需對架構進行修改便完成權限控制的挑戰便是本文主要目的。而在權限管理之外，系統安全也會遇到需要藉由分析使用者對系統的操作情況的時候，其原因主要是為了能夠透過追蹤被記錄下的行為足跡來進行異常行為的追溯，以便資訊管理人員能夠分辨出有安全疑慮的紀錄，並且針對其進行應對。但是對於異質系統而言，由於每個系統的所負責的工作不同，將導致需要儲存的數據無法產生一致性，進而使得跨系統的紀錄儲存整合困難。基於前述挑戰，本文將提供一跨系統權限策略的管理系統設計，並進行結果展示及效益分析，最後對系統未來之規畫提出方向。

There will always be multiple systems within an organization, each of which has its own dedicated area of responsibility, but also because of the different areas of responsibility between them, resulting in loose and difficult authority management for heterogeneous systems.Under the premise, the main purpose of this paper is how to design a cross-system rights management platform so that it can control dynamic rights and allow heterogeneous systems to be integrated without modifying the architecture to complete the challenge of rights control.In addition to authority management, system security also encounters the need to analyze the user's operation of the system. The main reason is to trace the abnormal behavior by tracking the recorded behavior footprints, so that the information can be traced back. Managers can identify records with security concerns and respond to them.However, for heterogeneous systems, due to the different tasks of each system, the data that needs to be stored cannot be consistent, which makes it difficult to integrate record storage across systems.
Based on the aforementioned challenges, this paper will provide a management system design for a cross-system authority strategy, display the results and analyze the benefits, and finally put forward directions for the future planning of the system.

摘要 i
Abstract ii
誌謝 iii
目錄 iv
圖目錄 vi
表目錄 ix
第一章、緒論 1
1.1研究動機 1
1.2研究目的 1
第二章、技術原理與文獻探討 3
2.1 Attribute-based access control 3
2.2 Flask-Security 4
2.3 User Tracking 5
第三章、系統分析與設計 7
3.1系統架構 7
3.1.1　Row-level security系統說明 9
3.1.2　ABAC架構說明 10
3.1.3　API權限系統說明 10
3.1.4　Log系統說明 11
3.1.5　登入與資料庫等系統說明 12
3.2資料模型 24
3.3系統功能 25
3.3.1使用者管理 25
3.3.2角色/群組管理 27
3.3.3 功能權限管理 28
3.3.5 權限判斷(AOP) 29
3.3.5 紀錄(Log)管理 30
3.5開發環境 31
第四章、系統開發與測試 33
4.1測試環境 33
4.2測試設計與結果 34
4.2.1 Analytics—Authorization 34
4.2.2 Application—Authorization 36
4.2.3 Application—Authorization 38
4.2.4 Developer—Authorization 40
4.2.2 Application—Authentication 41
4.2.7 系統測試—Log追蹤 44
4.3效益分析 46
第五章、結論與展望 49
5.1結論 49
5.2未來方向 49
參考文獻 52
附錄 54

[1] Authentication and Authorization of Users and Services in Federated SOA Environments—Challenges and Opportunities，IST-091
[2] What Exactly Is Role-Based Access Control? (RBAC)，https://www.wallarm.com/what/what-exactly-is-role-based-access-control-rbac，[visiter in 2022/3/19]
[3] Role-based access control overview，https://dsonoda.medium.com/role-based-access-control-overview-257de64534c，[Visiter in 2022/3/19]
[4] 5 Levels of User Behavior Monitoring，https://www.ekransystem.com/en/blog/5-levels-user-behavior-monitoring，[visiter in 2022/3/22]
[5] Snowflake Row Level Security in Plain English，https://www.analytics.today/blog/snowflake-row-level-security-in-plain-english，[visiter in 2022/3/20]
[6] 110年資通系統防護基準驗證實務V1.0。行政院國家資通安全會報技術服務中心
[7] NIST Special Publication 800-53B，Control Baselines for Information Systems and Organizations
[8] Information technology — Security techniques — Information security management systems — Requirements，ISO/IEC 27001
[9] Flask-Security，https://pythonhosted.org/Flask-Security/，[visiter in 2022/3/20]
[9] Identity-Aware Proxy，https://cloud.google.com/iap?hl=zh-tw，[visiter in 2022/3/28]
[10] 身分與存取權管理(IAM)，https://cloud.google.com/iam?hl=zh-tw，[visiter in 2022/3/28]
[11] BeyondCorp：A New Approach to Enterprise Security，https://research.google.com/pubs/pub43231.html?hl=zh-tw，[visiter in 2022/3/29]
[12] Google Zero Trust: Ultimate Guide to BeyondCorp | Google Cloud，https://securityonline.info/google-zero-trust-ultimate-guide-to-beyondcorp-google-cloud/，[visiter in 2022/3/20]
[13] Zero-Trust Security on GCP With Context-Aware Access，https://blog.realkinetic.com/zero-trust-security-on-gcp-with-context-aware-access-a180b3b2bc5d，[visiter in 2022/3/30]
[13] 傳輸層安全性協定，https://zh.m.wikipedia.org/zh-tw/%E5%82%B3%E8%BC%B8%E5%B1%A4%E5%AE%89%E5%85%A8%E6%80%A7%E5%8D%94%E5%AE%9A，[visiter in 2022/4/2]
[14] 資安與帳號管理-什麼事Cloud IAM?GCP權限管理服務介紹，https://blog.cloud-ace.tw/identity-security/what-is-cloud-iam/，[visiter in 2022/4/5]
[15] Cloud SQL features，https://cloud.google.com/sql/docs/features?hl=zh-tw，[visiter in 2022/1/5]
[16] Oso Filter Data，https://docs.osohq.com/guides/data_filtering.html，[visiter in 2022/5/25]
[17] ABAC-基於屬性的訪問控制－複雜場景下訪問控制解決之道，https://blog.csdn.net/XiaoBeiTu/article/details/100773968，[visiter in 2022/2/5]