RBAC中职责分离策略的一致性分析与判定方法  

An Approach for Consistency Analysis and Decision of SoD in Role-based Access Control

作　　者：熊厚仁[1,2] 陈性元[1,2] 杜学绘[1,2] 刘洋[1,2] 

机构地区：[1]解放军信息工程大学,郑州450001 [2]河南省信息安全重点实验室,郑州450001

出　　处：《小型微型计算机系统》2016年第5期1084-1090,共7页Journal of Chinese Computer Systems

基　　金：国家"八六三"高技术研究发展计划项目(2012AA012704)资助;2014年河南省基础研究计划项目(142300413201;142300410093)资助;信息保障技术重点实验室(KJ-13-110)资助

摘　　要：针对基于角色的访问控制模型中职责分离策略易存在冗余、冲突等一致性问题,提出一种职责分离策略的一致性分析与判定方法.从职责分离策略之间的一致性和职责分离策略与权限衍生关系之间的一致性两个方面对职责分离策略的一致性问题进行了分析.分别对两种一致性问题进行了形式化定义并给出了相应判定定理.基于一致性判定定理,给出了职责分离策略的一致性判定算法,从正确性和复杂度两个方面分析了算法的正确性和执行效率,说明算法可有效判定系统中职责分离策略的一致性.最后,实例分析验证了一致性分析与判定方法的可行性和算法的有效性.Due to the potential redundancy and conflict of SoD （ Separation of Duty） policy which may influence its consistency in RBAC （Role-Based Access Control ） model, a consistency analysis and decision approach for SoD is proposed and discussed from two aspects：the consistency between multiple SSoD （Static SoD） policies and that between each SSoD policy and the privilege derivation relation. The consistency between multiple SSoD policies is described formally from the point of policy dependency, and the corresponding decision theorem is present and proved. By introducing derivation cover of a privilege set, the definition of the consistency between SSoD policy and privilege derivation relation is given, followed with minimum derivation cover and decision theorem of the consistency. Based on the definition and decision theorem of the consistency, an efficient consistency decision algorithm is designed accordingly, with the correctness, validity and complexity being discussed. The application example shows that the work of this paper is useful to eliminate the redundancies between multiple SSoD policies and conflicts between SSoD policy and the implicit authorization caused by privilege derivation, serving the satisfiability and realization of the SSoD policy＇s consistency.

关 键 词：访问控制 基于角色的访问控制 职责分离 互斥角色约束 一致性 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]