基于属性的用户-角色委派模型可达性分析  

Reachability analysis for attribute based user-role assignment model

作　　者：任志宇[1,2,3] 陈性元[1,2] 

机构地区：[1]信息工程大学,郑州450001 [2]河南省信息安全重点实验室,郑州450004 [3]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机应用》2014年第2期428-432,共5页journal of Computer Applications

基　　金：国家973计划项目(2011CB311801);河南省科技创新人才计划项目(114200510001)

摘　　要：针对传统基于角色的访问控制(RBAC)管理模型难以表达多样化策略的问题,提出了基于属性的用户-角色委派(ABURA)模型,采用属性作为用户-角色委派的先决条件,丰富了RBAC管理策略的语义。用户-角色可达性分析是验证分布式系统中授权管理策略正确性的重要机制,定义了ABURA模型的用户-角色可达性分析问题,通过分析ABURA模型状态转换特点给出策略约减定理,设计了可达性分析算法,并通过实例对算法进行了验证。It is difficult to express diversity policy by traditional RBAC （ Role-based Access Control） management model. In order to solve the problem, an Attribute based User-Role assignment （ABURA） model was proposed. Attributes were adopted as prerequisite conditions to provide richer semantics for RBAC management policy. In distributed systems, user-role reachability analysis is an important mechanism to verify the correctness of authorization management policy. The definition of user-role reachability analysis problem for ABURA model was given. According to the characteristics of state transition in ABURA model, some reduction theorems for policy were given. Based on these theorems, user-role reachability analysis algorithm was proposed, and the algorithm got verified through examples.

关 键 词：授权管理模型 可达性分析 属性 角色 用户-角色委派 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]