中国科学院软件研究所机构知识库
Advanced  
ISCAS OpenIR  > 中科院软件所  > 中科院软件所
题名:
基于属性的访问控制模型与应用研究
作者: 翟征德
答辩日期: 2008-01-14
授予单位: 中国科学院软件研究所
授予地点: 软件研究所
学位: 博士
关键词: 基于属性的访问控制 ; 基于角色的访问控制 ; 跨域授权 ; 委托 ; 安全模型。
其他题名: Research on Model and Application of Attribute Based Access Control
摘要: 访问控制是一种重要的信息安全支撑技术,提供对资源的机密性和完整性保护。基于属性的访问控制(ABAC)是一种新兴的访问控制技术,基于用户、资源和环境的安全属性进行授权,具有细致的授权粒度和灵活的属性框架,可以容易地描述多种安全策略。RBAC是一种有代表性的ABAC,显著降低了安全管理的代价,取得了广泛的现实应用。本文以ABAC及其特例—RBAC为中心,重点关注了访问控制模型、委托授权管理和跨域授权应用、实现框架,取得了以下研究成果: 1. 提出了一个灵活的形式化的基于属性的访问控制模型(F-ABAC)。该模型提供了灵活的属性与授权框架,能够精确描述多种访问控制策略;采用了一种细致和灵活的策略组合方法,允许同时实施多种访问控制策略。 2. 研究了基于ABAC的细粒度可控委托授权管理应用。首先以RBAC作为参考模型,提出了一个形式化的基于量化角色的可控委托模型QBCDM,引入了量化角色的概念,提供了灵活的委托粒度,避免了引入较高的管理代价;实现了一种结合强制与自主特征的细粒度委托约束机制,保证了多步委托过程中委托能力的收敛性。然后,将该模型的思想和方法推广到ABAC委托。 3. 研究了基于ABAC的跨域授权应用。首先以RBAC作为参考模型,提出了一个适用于大规模、开放式环境的细粒度可控委托授权模型FCDAM,基于信任度实现了对角色中具有不同敏感度的权限的传播控制;然后将相关思想和方法推广到基于ABAC策略的委托授权模型,为构建基于Internet的虚拟计算环境提供了一种有力的授权支撑技术。对安全互操作中角色映射引起职责分离约束违反的原因、检测方法和先决条件进行了讨论。提出了IRBAC2000违反静态互斥角色约束的充要条件和约束违反检测算法;给出了添加角色关联和用户/角色分配的先决条件,进而将相关结论推广到ABAC安全互操作,保证了互操作过程始终满足静态职责分离约束。 4. 基于XACML和SAML设计并实现了一个基于属性的通用访问控制中间件,实现了跨管理域的匿名资源访问控制,降低了上层应用开发的代价,增强了访问控制决策功能的可重用性,为ABAC的现实应用提供了技术支持。 总的来说,本文的理论研究成果从模型、委托授权管理和跨域授权应用三个角度促进了ABAC和RBAC的研究,本文提出的中间件架构为推动ABAC的现实应用奠定了技术基础。
英文摘要: Access control is an important supporting technique for information security, which provides confidentiality and integrity protection for resources. As a new and promising technique, ABAC performs authorization decision according to the attributes of the users’, resources’ and environments’. ABAC provides fine authorization granularity and flexible attribute framework, which enables it to describe multiple policy types. As a typical example of ABAC, RBAC can significantly decrease the cost of security administration and has achieved wide usage. Centering on ABAC and RBAC (as a special case of ABAC), the paper focuses on ABAC model、framework of realization、delegation based authorization management and cross-domain authorization applications and has obtained the following achievements: A Flexible Attribute Based Access Control model (F-ABAC) is proposed. A flexible attribute framework is provided, which can accurately describe multiple policy types. A flexible policy combining method is presented, which enables the administrators to accurately define the ways resources are protected. F-ABAC can be used to enforce multiple access control policies simultaneously. ABAC based authorization management through delegation is researched. RBAC taken as an example, a formal Quantified-role Based Controllable Delegation Model (QBCDM) is proposed. The concept of quantified-role is introduced, which provides flexible delegation granularity, while avoiding incurring high administrative cost. A fine-grained delegation constraint mechanism with both mandatory and discretionary characteristics is presented, which ensures the constringency of users’ delegation ability in multi-step delegations. Then ideas and realization mechanisms of QBCDM is generalized to ABAC delegation. ABAC based cross-domain authorization is researched. As to trust management, RBAC taken as an example, a Fine-grained Controllable Delegation Authorization Model (FCDAM) suitable for large-scale open environments is proposed, in which trustworthiness is used to achieve propagation control of permissions of different sensitivity level in role. Then the ideas and realization mechanisms of FCDAM is generalized to delegation authorization model based on ABAC policy, which provides an effective authorization technique for constructing virtual computation environments on Internet. As to cross-domain secure interoperation, a method of detecting and avoiding violation of Static Mutual Exclusive Roles (SMER) constraints is presented. The reason and the necessary and sufficient conditions for SMER constraint violations are analyzed and proposed. The prerequisite conditions for adding new role associations and user/role assignments are given, which can ensure that SMER constraints are always abided by. The conclusions are also generalized to ABAC secure interoperation. A Universal Access Control Decision (UACD) middleware, which enforces ABAC, employing SAML and XACML, is designed and implemented. Anonymous cross-domain authorization decision is supported.UACD can help simplify the development of applications and enhance the reusability of access decision functions. It lays the foundation for ABAC’s usage in reality. In summary, from the perspectives of authorization model, delegation and cross-domain authorization, the theoretical achievements of the thesis promote both the research of ABAC and that of RBAC. The ABAC middleware architecture proposed lays a technical foundation for ABAC usage in reality.
语种: 中文
内容类型: 学位论文
URI标识: http://ir.iscas.ac.cn/handle/311060/6320
Appears in Collections:中科院软件所

Files in This Item:
File Name/ File Size Content Type Version Access License
10001_200418015029063翟征德_paper.doc(2331KB)----限制开放-- 联系获取全文

Recommended Citation:
翟征德. 基于属性的访问控制模型与应用研究[D]. 软件研究所. 中国科学院软件研究所. 2008-01-14.
Service
Recommend this item
Sava as my favorate item
Show this item's statistics
Export Endnote File
Google Scholar
Similar articles in Google Scholar
[翟征德]'s Articles
CSDL cross search
Similar articles in CSDL Cross Search
[翟征德]‘s Articles
Related Copyright Policies
Null
Social Bookmarking
Add to CiteULike Add to Connotea Add to Del.icio.us Add to Digg Add to Reddit
所有评论 (0)
暂无评论
 
评注功能仅针对注册用户开放,请您登录
您对该条目有什么异议,请填写以下表单,管理员会尽快联系您。
内 容:
Email:  *
单位:
验证码:   刷新
您在IR的使用过程中有什么好的想法或者建议可以反馈给我们。
标 题:
 *
内 容:
Email:  *
验证码:   刷新

Items in IR are protected by copyright, with all rights reserved, unless otherwise indicated.

 

 

Valid XHTML 1.0!
Copyright © 2007-2017  中国科学院软件研究所 - Feedback
Powered by CSpace