一种ABAC静态策略冲突检测算法  

A Static Policy Conflict Detection Algorithm for Attribute Based Access Control

作　　者：刘江[1,2] 张红旗[1,2] 代向东[1,2] 王义功[1,2] 

机构地区：[1]解放军信息工程大学电子技术学院,郑州450004 [2]河南省信息安全重点实验室,郑州450004

出　　处：《计算机工程》2013年第6期200-204,共5页Computer Engineering

基　　金：国家"973"计划基金资助项目(2011CB311801);国家"863"计划基金资助项目(2009AA01Z438)

摘　　要：在分布式计算环境下,传统基于属性的静态访问控制策略多存在扩展性差、难以实现等问题。针对上述问题,提出一种基于策略属性分解的冲突检测算法。该算法对策略属性进行分解,构造策略属性分解图,判断策略属性值之间的相交关系,根据静态策略冲突的定义进行策略冲突检测,从而提高策略冲突检测算法的可扩展性和易实现性。实验结果表明,该算法对静态策略冲突的检测率接近85%。This paper discusses static access control policy conflict detection of Attribute Based Access Control（ABAC） in the distributed computing environment, proposes a static policy conflict detection algorithm based on policy attributes decomposition. Policy attributes are decomposed and the graph of policy attributes decomposition is constructed. The intersection relationship between predicates of policy attribute is judged. The algorithm detects policy conflicts by the definition of static policy conflict which improves extensibility and achievability. Experimental result indicates that the policy conflict detection rate of proposed algorithm can reach 850.

关 键 词：基于属性的访问控制模型 策略管理 静态策略 策略冲突 策略属性分解 冲突检测 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]