【作者】 邹华；

【导师】 杨放春；

【作者基本信息】 北京邮电大学 ， 计算机科学与技术， 2010， 博士

【摘要】 网络发展的根本目的是能够方便、快捷地提供满足用户需求的业务。在下一代网络NGN中,通过业务能力的开放,新的业务可通过组合已有的业务能力来实现,从而不但可以进一步提高新业务的提供速度,降低新业务的提供成本,而且可以向终端用户提供单一业务运营商难以独自提供的、需要使用多个业务运营商独特业务特征的业务。与网络能力开放类似,业务能力的开放也带来了一系列业务层特有的安全问题。在电信领域,国内外对下一代网络的安全问题研究主要集中在对下一代网络安全体系结构的规划上,并侧重于业务层之下的控制层、传输层和接入层,对位于高层的业务能力开放所引入的安全问题还没有进行深入的研究。在IT领域,应用跨域互操作的安全问题研究是当前安全领域的研究热点,并取得了一定的研究成果。本文基于这些研究成果,根据NGN业务跨域互操作的特点,对NGN业务跨域互操作的访问控制问题进行了深入的研究,取得了相应的研究成果,概括如下：(1)根据NGN业务跨域互操作的访问控制需求,提出了一种业务跨域互操作访问控制方法RABAC (Role and Attribute Based Access Control)。与基于角色的访问控制方法RBAC相比,该方法具有良好的灵活性,能够根据业务主体的上下文情况进行相应的访问控制。与基于属性的访问控制方法ABAC相比,该方法首先通过角色对属性条件进行分组以解决基于属性的权限规则繁琐易冲突的问题,然后通过对内角色和对外角色的分离,为业务自主地创建自己的安全角色提供良好的支持,并有助于降低安全域对映射关系管理的复杂度以及域间属性数据传递需求。(2)为尽可能发挥RABAC方法的作用,提出了对外角色的生成方法和相应的角色映射关系构建方法。基于聚类和分类算法使得生成的对外角色可以较好地反映角色间的内在关系,并能够比较准确地完成大部分角色间映射关系的建立。不但可减轻安全域管理员的工作量,而且建立的角色间映射关系大多为一对一或者多对一,有助于保障角色映射的性能。(3)针对域间可能存在欺骗的问题,提出了一种RABAC域间信任保障机制。根据概率分布情况进行信任度的初步评估,然后再根据需要进行相对准确的信任度评估,并基于评估结果进行惩罚,有助于提升域间不信任情况下域间交互的安全性。(4)提出了一种业务能力安全开放的安全服务平台的概念模型,基于该模型提出了一种支持RABAC的提供跨域访问控制支持的安全服务平台实现方法,该方法具有良好的可扩展性。更多还原

【Abstract】 Providing service with rich user experience is a goal of converged network. Service capability is provided by open APIs in NGN, so applications can be composed by some existing capabilities, which speeds up service creation procedure and reduces cost of creation. Beyond that, some application can even combine some capabilities coming from different service providers.Similar to the openness of network capability, the openness of application capability also introduces some security problems which are unique in application layer. The researches on NGN security focus on NGN security architecture, which mainly discusses about control layer, transport layer and access layer. There is little discussion on security problem which is introduced by high layer openness.In IT domain, inter-domain interaction introduces new security problem. This problem is also a hot topic in current area. Based on result from IT domain, we move research forward onto NGN domain. And some researches and results are carried out as follows:1) An Inter-domain interaction access control method is proposed, which is called RABAC(Role and Attribute Based Access Control). Compared to RBAC, our method is easier to apply access control function according to context. And it groups similar attributes before role mapping. It is more simple and easy than pure ABAC method as there are less attributes under consideration. With the separation between in-role and out-role, it also helps applications to create new security role and reduce the complexity of management.2) An Out-role creation method is proposed, which is based on cluster and classification algorithm. Based on those algorithms, out-roles are created automatically. And as out-role is created by on similarity, it might be more accurate than manually creation. At the time when roles are created, mappings between out-role and local role are also established. So this method would help system administrator to manage roles and setup mapping easier.3) As there would be some frauds between domains, an inter-domain trust ensurance method is proposed. Based on the statistics, we evaluated the trust of incoming requests. And based on the evaluation, if any cheating behavior is found, we start the punish procedure. This method would secure the interaction between untrusted domains. 4) Finally, a concept model of security service platform with capability openness is provided. Detail implementation of this model is also fully discussed. This model can also be extended easily.更多还原