基于RBAC的跨多企业服务组合访问控制模型  

RBAC based access control model for services compositions cross multiple enterprises

作　　者：张帅[1] 孙建伶[1] 徐斌[1] 黄超[1,2] KAVS Aleksander J 

机构地区：[1]浙江大学计算机科学与技术学院,浙江杭州310027 [2]道富信息科技(浙江)有限公司,浙江杭州310012

出　　处：《浙江大学学报（工学版）》2012年第11期2035-2043,共9页Journal of Zhejiang University：Engineering Science

摘　　要：为了解决单域环境下访问控制模型无法满足跨企业服务组合的访问授权需求的问题,提出一种以基于角色访问控制(RBAC)为基础的多域动态访问授权模型.根据组合服务的流程结构分析服务执行所需的权限,提出一个权限最小化的角色集挖掘算法,从原有的面向单域的角色授权关系中搜索满足服务执行的角色集.针对组合服务中的跨域操作进行端对端的域间自主授权协商,并根据挖据出的角色集建立最小成本的跨域角色映射以满足跨域访问授权需求.在此基础上提出一套与现有的工业标准相结合运行时框架,实现根据组合服务实际运行状态进行授权的动态访问控制机制.模拟实验结果验证模型中的该算法的主要部分在多种不同场景下的有效性.A dynamic multiple domains access control model base on role based access control（RBAC） was proposed in order to solve the problem that current single domain based access control model cannot fulfill the authorization requirements for service compositions crossing multiple enterprises.The process structures were analyzed and a role mining algorithm was proposed to find the role set with minimized permissions that meet the access requirements of composite services.Authorization negotiations were set up among relevant domains for each cross domain operation in composite services and cross domain role mappings were built according the mined role sets with minimized cost to fulfill the cross domain operations.Based on this model,a runtime framework aligned with current industry standard was proposed to authorize dynamically based on the current running status of composite services.Simulation experiments showed the effectiveness of key part of the role mining algorithm.

关 键 词：服务组合 访问控制 RBAC 跨多企业 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]