基于双层角色映射的跨域授权管理模型  

Cross-domain authorization management model based on two-tier role mapping

作　　者：任志宇[1,2,3] 陈性元 单棣斌[1,2,3] 

机构地区：[1]信息工程大学四院,郑州450001 [2]河南省信息安全重点实验室,郑州450004 [3]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机应用》2013年第9期2511-2515,共5页journal of Computer Applications

基　　金：国家973计划项目(2011CB311801);河南省科技创新人才计划项目(114200510001)

摘　　要：针对传统跨域授权管理模型角色设置方法单一,以及有可能出现隐蔽提升、职责分离冲突等问题,提出一种基于双层角色结构的跨域授权管理模型。通过在管理域内设置双层角色,使得角色的设置与管理更加符合现实需求;采用单向角色映射的方式杜绝映射环路;引入属性、条件等动态因素,实现了权限的动态调整。采用动态描述逻辑刻画了模型中的概念、关系及管理动作。对模型的安全性分析表明,该模型满足自治性和安全性原则。With regard to the singleness of the role establishment method in the traditional cross-domain authorization management models, and the problems such as implicit promotion of privilege and the separation of duties conflict, a new cross-domain authorization management model based on two-tier role mapping was proposed. The two-tier role architecture met the practical needs of role establishment and management. On this basis, unidirectional role mapping can avoid the role mapping rings. By introducing attribute and condition, dynamic adjustment of permissions was realized. The model was formalized by dynamic description logic, including concepts, relations and management actions. In the end, the security of the model was analyzed.

关 键 词：信息安全 多域安全互操作 跨域角色映射 授权管理模型 动态描述逻辑 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]