通过RBAC和TE模型融合实现Clark-Wilson模型(英文)  

Enforcement of Clark-Wilson model in combination of RBAC and TE models

作　　者：袁春阳[1] 邓晨蕾[2] 

机构地区：[1]国家计算机网络应急技术处理协调中心,北京100029 [2]中国科学院研究生院,北京100049

出　　处：《中国科学院研究生院学报》2010年第4期538-546,共9页Journal of the Graduate School of the Chinese Academy of Sciences

基　　金：Supported by National 863 Hight-tech Research Development Program of China (2006AA01Z451,2007AA010505,and 2009AA01Z432)

摘　　要：提出通过融合RBAC和TE模型来实现Clark-Wilson模型的一种方法,即:通过不同用户赋予不同角色实现责任分立;利用特殊的域表示变换过程;使用不同的类型标识约束数据项和非约束数据项.分析了实施和认证规则的正确性.通过在SEBSD系统中实施了FTP的完整性安全策略的实例,说明该方法能够实现细粒度的访问控制和灵活配置.An approach to enforce Clark-Wilson model in the combination of RBAC and TE models is presented,namely：separation of duties is addressed by assigning different roles to different users;special domains are used for representing transformation procedures;and the constrained data items and unconstrained data items are labeled with different types.The correctness of the enforcement and certification rules is analyzed.A detailed case study of FTP integrity policy is implemented under SEBSD,and shows that the approach achieves fine-grained access control and flexible configuration.

关 键 词：安全操作系统 CLARK-WILSON模型 RBAC模型 TE模型 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]