基于合约的Web服务个性化访问控制方法  

A smart contract based personalized access control method towards Web service

作　　者：胡斌[1,2] 赵晓芳 宋永浩[1] 于雷 段东圣[3] 张程[1] Hu Bin;Zhao Xiaofang;Song Yonghao;Yu Lei;Duan Dongsheng;Zhang Cheng(Institute of Computing Technology,Chinese Academy of Sciences,Beijing 100190;University of Chinese Academy of Sciences,Beijing 100049;National Computer Network Emergency Response Technical Team/Coordination Center of China,Beijing 100029)

机构地区：[1]中国科学院计算技术研究所,北京100190 [2]中国科学院大学,北京100049 [3]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《高技术通讯》2021年第9期901-909,共9页Chinese High Technology Letters

基　　金：国家自然科学基金(U1836111,U1736106);国家重点研发计划(2018YFB0904503)资助项目。

摘　　要：在无中心Web服务环境中,用户访问服务的历史行为数据由多个服务提供方分散管理,难以形成全局的用户信任度视图,难以根据用户信任度和使用需求实施个性化的访问控制。本文提出一种基于智能合约的个性化访问控制方法(SC-PAC)。通过结合前期的研究成果为SC-PAC提供高质量的用户历史行为数据,实现有可靠数据保障的可信计算服务,通过智能合约中的策略配置及可信度计算模型参数调整,实现服务提供商(SP)对不同用户的个性化的访问控制。在实验环节为SC-PAC设计了一个新的信任模型,并对该信任模型及基于SC-PAC方法的访问控制进行了实验设计。对结果的分析表明,本文提出的SC-PAC方法能够允许SP通过智能合约中的计算信任模型、参数及访问控制策略选择,实现对用户的个性化访问控制,并且依据准确的用户历史行为数据提供更可靠的可信度判断,可以有效保护服务。Trust based dynamic access control(TBAC)is one major technique on protecting service providers’(SPs)resources.The personalized access control and the reliability of trust are the central problems of TBAC.To solve it,this paper proposes a smart contract based personalized access control method(SC-PAC).It introduces a smart contract-based access control procedure,which allows SPs to flexibly set the trust model,parameters,and the access control policies,to provide a customer-level personalized access control.Combined with the previous work,reliable behavior data of users are provided to ensure a reliable trust evaluation.A new trust model is designed in case study and experiments are designed to test this trust model and the SC-PAC method.The results of experiments show that the SC-PAC can provide a customer-level personalized access control compared with the traditional work and a more reliable trust evaluation through the accurate behavior data of users.

关 键 词：WEB服务 信任评估 个性化 动态访问控制 智能合约 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]