基于动态情景网关的系统协同访问控制模型

doi:10.3969/j.issn.1000-436x.2013.z1.018

通信学报 ›› 2013, Vol. 34 ›› Issue (Z1): 142-147.doi: 10.3969/j.issn.1000-436x.2013.z1.018

基于动态情景网关的系统协同访问控制模型

郭树行,张禹

中央财经大学信息学院，北京 100081

出版日期:2013-08-25 发布日期:2017-06-23
基金资助:
国家自然科学基金资助项目;国家自然科学基金资助项目;国家自然科学基金资助项目;教育部科学技术重点项目基金;人文社会科学研究青年基金资助项目;中央财经大学学科建设基金资助项目

Dynamic situation gateway based system cooperation access gatel model

Shu-hang GUO,Yu ZHANG

School of Information, Central University of Finance and Economics, Beijing 100081, China

Online:2013-08-25 Published:2017-06-23
Supported by:
The National Natural Science Foundation of China;The National Natural Science Foundation of China;The National Natural Science Foundation of China;The Key Project of Ministry of Education;MOE (ministry of education in China) Project of Humanities and Social Sciences;The Construction Fund of Subjects of Central University of Finance and Economics

摘要/Abstract

摘要：

为适应网构问环境下应用系统主客体间访问集中控制的需要，提出了一种基于动态情景网关的系统协同访控制模型DSGAC。首先，给出了网构应用系统中访问的动态情景要素构成，从多视角定义了情景要素；其次，提供动态情景状态机的概念，并给出了动态情景机约束下的系统协同访问网关模型DSGAC，支持情景状态演算、规则演算；最后，实际案例应用验证表明DSGAC模型在应用系统的应用可行性，并归纳了其与现有访问控制模型的相对创新性。

关键词: 情景网关, 系统协同, 访问控制, 情景演算, 状态机

Abstract:

In order to adapt the centralized access control between the application system subject and object in the envi-ronment of network configurations, a dynamic situation based system cooperation access gatel model — DSGAC was proposed. To begin with, the constitution of dynamic situational factors of access controls in the application systems of network configurations was analyzed, defining the factor of situation from muti-perspective. Furthermore, the concept of dynamic situational finite state machine was provided and a system cooperation access gatel model supporting calcula-tions and rules of the situation was presented under the constraint of dynamic situations. Finally, the real case application shows the feasibility and validation of the DSGAC model between the application systems. Additionally, the relative in-novativeness between DSGAC model and existing access control models was summerized.

Key words: situation gatel, system cooperation, access control, situation calculation, finite state machine

郭树行,张禹. 基于动态情景网关的系统协同访问控制模型[J]. 通信学报, 2013, 34(Z1): 142-147.

Shu-hang GUO,Yu ZHANG. Dynamic situation gateway based system cooperation access gatel model[J]. Journal on Communications, 2013, 34(Z1): 142-147.

图/表 4

表1

情景构造操作字典"

op	操作说明
情景初始	$I n i t (S) \mapsto S_{0}$
情景更新	Update(S_i?1 ,S_i)，其中S_i-1,S_i两者权限、使用约束、前置需求与使用条件有区别
情景授权	Deploy (Subject_x,S_i,Object_y)
情景撤权	Destroy (Subject_x,S_i,Object_y)
情景代理	Delegate (Subject_x ,Subject_w),t∈(t_m,t_n)
情景转发	Derive (Subject_x,Subject_w),t∈(t_m,t_n)

表1

图2

图3

图4

参考文献 11

[1]	SANDHU R , COYNE E J , FEINSTEIN H L , et al. Role-based access control models[J]. IEEE Computer, 1996,29 (2):38-47.
[2]	SANDHU R , MUNAWER Q . The ABRAC99 model for role based administration of roles[J]. ACM Transactions on Information and Sys-tem Security, 1999,2 (1):105-135.
[3]	PANG C Y , HANSEN D , MAEDER A . Managing RBAC States with transitive relations[A]. Proceedings of the 2nd ACM Sym-posium on Information, Computer and Communications Security(ASIACCS'07)[C]. Singapore, 2007.139-148.
[4]	JOSHI J B D , BERTINO E , LATIF U , et al. A generalized temporal role-based access control model[J]. IEEE Transactions on Knowledge and Data Engineering, 2005,17 (1):04-23.
[5]	王小明，赵宗涛．基于角色的时态对象存取控制模型[J]．电子学报， 2005,09,33(9):1634-1638. WANG X M , ZHAO Z T . Role-based access control model of tempo-ral object[J]. Acta Electronica Sinica, 2005,09,33(9):1634-1638.
[6]	许峰，赖海光，黄皓等．面向服务的角色访问控制技术研究[J]．计算机学报， 2005,28(4):686-693. XU F , LAI H G , HUANG H , et al. Service-oriented role-based access control[J]. Chinese Journal of Computers, 2005,28(4):686-693.
[7]	徐伟，魏峻，李京．面向服务的工作流访问控制模型研究[J]．计算机研究与发展， 2005,42(8):1369-1375. XU W , WEI J , LI J . A service-oriented workflow access control model[J]. Journal of Computer Research and Development, 2005,42(8):1369-1375.
[8]	李晓峰，冯登国，陈朝武等．基于属性的访问控制模型[J]．通信学报， 2008,29(4):90-98. LI X F , FENG D G , CHEN Z W , et al. Model for attribute based access control[J]. Journal on Communications, 2008,29(4):90-98.
[9]	KERN A , WALHORN C . Rule support for role based access con-trol[A]. Proceedings of the Tenth ACM Symposium on Access Control Models and Technologies[C]. Stockholm, Swden, 2005.38-130.
[10]	YUAN E , TONG J . Attributed based access control(ABAC)for Web service[A]. Proceedings of the 2005 IEEE International Conference on Web Services[C]. Orlando FL, USA, 2005.561-569.
[11]	DOUGHERTY D J , FISLER K , KRISHNAMURTHI S . Specifying and reasoning about dynamic access-control policies[A]. 3rdInterna-tional Joint Conferenceon Automated Reasoning(IJCAR)[C]. Seattle, USA, 2006.632-646.

[1]	金伟, 李凤华, 余铭洁, 郭云川, 周紫妍, 房梁. 面向HDFS的密钥资源控制机制[J]. 通信学报, 2022, 43(9): 27-41.
[2]	梁晓艳, 杜瑞忠. IoT下CapBAC规则语义表示及其时间间隔粗糙性分析[J]. 通信学报, 2021, 42(9): 43-53.
[3]	董江涛, 闫沛文, 杜瑞忠. 雾计算中基于无配对CP-ABE可验证的访问控制方案[J]. 通信学报, 2021, 42(8): 139-150.
[4]	彭长根, 彭宗凤, 丁红发, 田有亮, 刘荣飞. 具有可撤销功能的属性协同访问控制方案[J]. 通信学报, 2021, 42(5): 75-86.
[5]	应作斌, 斯元平, 马建峰, 刘西蒙. 基于区块链的分布式EHR细粒度可追溯方案[J]. 通信学报, 2021, 42(5): 205-215.
[6]	杜瑞忠, 闫沛文, 刘妍. 雾计算中细粒度属性更新的外包计算访问控制方案[J]. 通信学报, 2021, 42(3): 160-170.
[7]	张嘉伟, 马建峰, 马卓, 李腾. 云计算中基于时间和隐私保护的可撤销可追踪的数据共享方案[J]. 通信学报, 2021, 42(10): 81-94.
[8]	诸天逸,李凤华,金伟,郭云川,房梁,成林. 互操作性与自治性平衡的跨域访问控制策略映射[J]. 通信学报, 2020, 41(9): 29-48.
[9]	周清雷,班绍桓,韩英杰,冯峰. 针对物理访问控制的拟态防御认证方法[J]. 通信学报, 2020, 41(6): 80-87.
[10]	贾春福,哈冠雄,李瑞琪. 密文去重系统中的数据访问控制策略[J]. 通信学报, 2020, 41(5): 72-83.
[11]	付永贵,朱建明. 基于区块链的数据库访问控制机制设计[J]. 通信学报, 2020, 41(5): 130-140.
[12]	谢绒娜,李晖,史国振,郭云川. 基于属性轻量级可重构的访问控制策略[J]. 通信学报, 2020, 41(2): 112-122.
[13]	刘敖迪, 杜学绘, 王娜, 乔蕊. 基于深度学习的ABAC访问控制策略自动化生成技术[J]. 通信学报, 2020, 41(12): 8-20.
[14]	谢绒娜, 李晖, 史国振, 郭云川, 张铭, 董秀则. 基于区块链的可溯源访问控制机制[J]. 通信学报, 2020, 41(12): 82-93.
[15]	丁红发,彭长根,田有亮,向淑文. 基于演化博弈的隐私风险自适应访问控制模型[J]. 通信学报, 2019, 40(12): 9-20.

基于动态情景网关的系统协同访问控制模型

Dynamic situation gateway based system cooperation access gatel model

在线阅读

PDF下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 11

相关文章 15

Metrics

推荐阅读 0