一种基于量化用户和服务的大规模网络访问控制方法  

An Access Control Method Based on Quantified Services and Roles in Large Scale of Network Visits

作　　者：刘庆云[1,2,3,4] 沙泓州 李世明[5,3] 杨嵘[2,3] 

机构地区：[1]中国科学院计算技术研究所,北京100193 [2]中国科学院信息工程研究所,北京100190 [3]信息内容安全技术国家工程实验室,北京100190 [4]中国科学院大学,北京100049 [5]北京邮电大学计算机学院,北京100876

出　　处：《计算机学报》2014年第5期1195-1205,共11页Chinese Journal of Computers

基　　金：国家"八六三"高技术研究发展计划项目(2011AA010703);中国科学院战略性先导科技专项(XDA06030200);国家科技支撑计划(2012BAH46B02)资助~~

摘　　要：目前,传统的RBAC(Role-Based Access Control)访问控制模型在支持细粒度服务和角色迁移的可控性上存在一定不足.针对这些不足,结合开放式网络环境的实际情况,文中提出了量化服务的概念,实现了一种基于细粒度角色和服务的访问控制机制,给出了一个形式化的基于量化服务和角色的访问控制模型QSRBAC(Quantified Services and Roles Based Access Control).该模型提供了灵活的访问控制粒度,支持对角色和服务的多角度访问控制,支持权限动态调整和条件角色迁移,可以用于大规模开放式网络环境.经测试,在百万规模规则的情况下,基于该模型的访问控制系统内存占用9.6GB以下,平均规则执行时间20μs以内.实验结果证明,该模型可以满足访问控制的效果和时间要求,它的应用显著增强了访问控制过程的可管理性.Due to the shortage of existing RBAC （Role-Based Access Control）model in supportingthe control of the role migration and fine-grained service,this paper proposes the concept ofquantified service and realize a fine-grained access control mechanism based on the quantifiedroles and services.Combined with the actual situation of an open network environment,it putsforward the formal definition of QSRBAC （Quantified Services and Roles Based Access Control）.The model provides a flexible access control granularity,supports the multi-angle access controlfor the roles as well as services,and supports the dynamic adjustment of rights and conditionalrole migration.Therefore,it can be used in the large-scale open network environment.Experi-ments show that when the scale of configuration is 1 million,the maximum amount of memoryrequired by the access control system is below 9.6GB,while the average execution time is below 20 microseconds.By this end,the model satisfies the effectiveness and delay requirements ofaccess control.And this model significantly enhances the manageability of access control process.

关 键 词：访问控制 量化角色 量化服务 细粒度 条件角色迁移 信息安全 网络安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]