基于行为的访问控制模型及其行为管理  

Action-Based Access Control Model and Administration of Actions

作　　者：李凤华[1,2] 王巍[1] 马建峰[1] 梁晓艳[1] 

机构地区：[1]西安电子科技大学计算机网络与信息安全教育部重点实验室,陕西西安710071 [2]北京电子科技学院研究生处,北京100070

出　　处：《电子学报》2008年第10期1881-1890,共10页Acta Electronica Sinica

基　　金：国家863高技术研究发展计划(No.2007AA01Z429,No.2007AA01Z472,No.2007AA01Z482);国家自然科学基金(No.60633020,No.60573036,No.60702059);陕西省“13115”科技创新工程重大科技专项(No.2007ZDKG-56)

摘　　要：访问控制模型是对信息资源进行授权决策的重要方法之一.首先给出了环境的定义,结合角色、时态和环境的概念,给出了行为的定义.在不同的信息系统中,行为可以用来综合角色、时态状态和环境状态的相关安全信息.然后介绍了行为、时态状态和环境状态的层次结构,提出了基于行为的访问控制模型ABAC(Action-Based AccessControl Model),并讨论了在ABAC模型中角色、时态状态和环境状态之间的相互关系.在此基础上,通过引入受限的时态状态和环境状态,给出了管理行为的定义和ABAC管理模型的结构;描述了ABAC管理模型下用户-管理行为、管理行为-管理权限的控制关系,使用Z-符号形式化地描述了行为状态管理中使用的管理函数AddAction、ModifyAction和DeleteAction,以及和ABAC管理模型相关的管理方法.与已有其他模型相比,ABAC模型更加适用于解决网络环境下支持移动计算的信息系统中的访问控制问题.Access control is one of the powerful and generalized approaches of authorization decisions on information resources. Firstly, the environmental state is introduced and the term ＂action＂ is defined based on roles, temporal states and environmental states. Actions can be used to capture security-relevant aspects of roles,temporal states and environmental states in different information systems. Then, the action hierarchy, temporal hierarchy, environmental hierarchy and Action-Based Access Control （ABAC）model are presented. And the relationship among roles, temporal states and environmental states are analyzed. By introducing the limited temporal states and environmental states, the administrative action and administrative model for ABAC are described. The controlling relations of user-administrative action and administrative action-administrative permission are proposed. By Z-notation, the functions of AddAction, ModifyAction and DeleteAction are introduced.Moreover, the related methods for ABAC administrative model are presented. Compared with the existing models,the ABAC model can solve the problem of access control in informarion systems with mobile computation.

关 键 词：访问控制 行为 环境状态 时态状态 管理行为 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]