基于属性的角色委派模型可达性推理方法研究  

Research on Reachability Reasoning Method for Attribute-based Role Assignment Model

作　　者：任志宇[1,2,3] 陈性元[1,2] 马军强[1] 

机构地区：[1]解放军信息工程大学四院,郑州450001 [2]河南省信息安全重点实验室,郑州450004 [3]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机工程》2014年第9期143-148,共6页Computer Engineering

基　　金：国家"973"计划基金资助项目(2011CB311801);河南省科技创新人才计划基金资助项目(114200510001)

摘　　要：提出基于属性的角色委派模型,通过引入属性扩展授权管理策略的表达能力,并采用描述逻辑定义模型的概念及其关系。为解决分布式环境下授权管理策略检测困难的问题,对模型的用户-角色可达性问题进行定义和分析,采用SWRL描述推理规则,利用推理引擎实现用户-角色可达性的自动推理,并通过应用实例对推理方法的正确性和可行性进行验证。实验结果表明,针对某一策略进行推理时所需的时间随策略数量的增加上升平缓,因此,该推理方法适用于授权管理策略的自动检测,可有效避免因策略执行结果不直观而引发的安全隐患,为授权管理模型的安全应用提供支撑。By introducing attributes to provide richer semantics for Role-based Access Control（RBAC）management policy,the attribute-based role assignment model is proposed. It is formalized by description logic,including concepts and relations. In order to resolve the difficulty of privilge management policy detection in distributed environment,the userrole reachability analysis problem is defined and analyzed. The inference rules are described by SWRL,and imported into the inference engine to realize automated reasoning. Application example shows that the reasoning method is correct and feasible. Experimental result shows that the reasoning time rises slowly by the count of policy. So the reasoning method is practical for the automatic policy detection. It can avoid potential security problems,and offer a basis for the safe application of the privilge management model.

关 键 词：属性 角色委派 可达性 推理 基于角色的访问控制 描述逻辑 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]