GTRBAC模型的安全性分析及其改进  

SECURITY ANALYSIS ON GTRBAC MODEL AND ITS IMPROVEMENT

作　　者：刘猛[1,2] 王轩[1] 

机构地区：[1]哈尔滨工业大学深圳研究生院计算机应用研究中心,广东深圳518055 [2]山东大学威海分校机电与信息工程学院,山东威海264209

出　　处：《计算机应用与软件》2012年第10期300-303,共4页Computer Applications and Software

摘　　要：Bertino等人提出了带有时间约束的RBAC模型-TRBAC(Temporal Role-based Access Control),该模型支持角色有效状态的周期性控制,也可通过实时请求角色事件改变角色的状态。Joshi等人在TRBAC模型基础上扩展并提出了一个新的时间RBAC模型——GTRBAC(Generalized Temporal Role-based Access Control)。该模型增加了用户-角色和角色-权限分配周期性时间约束和持续时间约束,以及角色激活持续时间约束和基数约束。首先对GTRBAC模型的安全性进行分析,指出Joshi给出的GTRBAC模型安全的充分条件是不全面的,分析原因并提出了保证该模型安全的充分条件的完整定义。Bertino et al. proposed a temporal role-based access control （TRBAC） model, which supports the periodic control on role＇ s valid state, besides, the state of a role can also altered by requesting timely the role event. Joshi et al. proposed a new temporal RBAC mod- el generalised TRBAC （GTRBAC） based on expanding the TRBAC. In this model, some periodic constraints and duration constraints on user-role and role-permission assignment are added, as well as the duration constraints and cardinality constraints on role activation. In this paper, we first analyse the security of GTRBAC model, and then point out that the sufficient conditions for GTRBAC model security given by Joshi is incomplete, and also analyse its cause and present a complete definition of sufficient condition for guaranteeing the security of the model.

关 键 词：基于角色的访问控制 时间约束 依赖触发器 事件 安全性 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]