一种高阶权限指派约束的安全性与一致性验证  

Safety and Consistency Verification for a High-level Permission Assignment Constraint

作　　者：王正 许德武[1] 韩建民[1] 鲁剑锋[1] 

机构地区：[1]浙江师范大学数理与信息工程学院,浙江金华321004

出　　处：《计算机工程》2018年第1期171-175,181,共6页Computer Engineering

基　　金：国家自然科学基金(61402418;61672468);教育部人文社科研究项目(12YJCZH142);浙江省公益技术研究社会发展项目(2017C33054);浙江省自然科学基金(LY13F020017;LY15F020013)

摘　　要：现有权限指派约束往往侧重于保障系统的安全性而忽略了可用性。为此,提出一种兼顾安全性与可用性需求的高阶权限指派约束。定义高阶权限指派约束的安全性验证和一致性验证问题,分别为验证一个访问控制状态是否能够满足一个高阶权限指派约束,以及判断是否存在某个访问控制状态能够满足多个高阶权限指派约束,并证明其在一般情形下分别是NP-complete和NPNP问题。结合预处理及规约为可满足性问题的求解器,设计针对一致性验证问题的优化求解算法。仿真实验结果验证了该算法的有效性。Existing permission assignment constraints pay more attention to ensure the safety,however the availability for the system is ignored. Aiming at this problem, this paper proposes a High-level Permission Assignment （ HPA ） constraint to satisfy the safety and availability requirements simultaneously. It defines the safety verification problem and consistency verification problem, which determine whether an access control state can satisfy a HPA constraint, and whether there exists a valid access control state to satisfy a set of high-level permission assignment constraints. The computing complexities of the safety verification problem and the consistency verification problem show that computing complexities of these two problems are NP-complete and NPNP. It also designs an optimized algorithm for the consistency checking problem by incorporating preprocessing and reducing to Satisfiability （SAT） problem solver. Simulation experimental results verify the effectiveness of the proposed algorithm.

关 键 词：访问控制 安全性 可用性 权限指派 SAT求解器 计算复杂度 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]