一种面向多域云系统的扩展RBAC模型  

An enhanced role-based access control model for multi-domains in cloud systems

作　　者：蔡婷[1] 聂清彬[1] 欧阳凯[2] 周敬利[2] 

机构地区：[1]重庆邮电大学移通学院计算机系,重庆401520 [2]华中科技大学计算机学院,湖北武汉430074

出　　处：《计算机工程与科学》2017年第4期689-697,共9页Computer Engineering & Science

基　　金：重庆市本科高校"三特行动计划"特色专业建设项目(渝教高(2013)49号);重庆市教委科学技术研究项目(KJ1502002;KJ1502003);重庆市教委科学"十二五"规划高等教育质量提升专项成果(2015-GX-086);重庆市高等教育学会2015-2016年度高等教育科学研究课题(CQGJ15203B)

摘　　要：提出一种扩展的基于角色的访问控制ERBAC模型,以解决RBAC在多域云系统的资源使用约束、策略管理和互操作安全性等方面存在的不足。首先,通过引入容器元素和两类角色基数约束,构建了基于容器元素+动态角色基数约束的资源使用策略;其次,深入研究了多域角色继承管理,提出基于先检测后建立角色关系的域间策略管理函数,并给出各类安全策略冲突检测算法。分析表明,ERBAC模型实现了资源使用约束、支持高效的安全策略管理,提高了跨域互操作的安全性,且性能测试说明了该模型在多域云系统中具有适应性和可行性。We propose an enhanced role-based access control （ERBAC） model to solve the shortcomings of the RBAC’s resource usage constraints, policy management and interoperability security in multi-domain cloud systems. Firstly, we introduce elements of containers and two role cardinality constraints into the RBAC, and establish the containers ＋ dynamic role cardinality constraints based resource usage policy. Secondly, we study the role inheritance management for multi-domains in depth and present an inter-domain policy management function, whose objective is to check for the number of violations before committing an inter-domain role inheritance relation. Then, various security detection algorithms for policy conflict are given. Analysis results show that the ERBAC model can improve the security of inter-domain interoperation, enforce usage constraints upon resources and manage the security policies in an easy and effective way, which proves to be feasible and applicable for multi-domain cloud systems.

关 键 词：ERBAC 多域云 安全互操作 资源使用 策略管理 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]