【作者】 蔡伟鸿；

【导师】 韦岗；

【作者基本信息】 华南理工大学 ， 通信与信息系统， 2012， 博士

【摘要】 随着网络技术的发展和互联网应用的日益增加，如何保证网络资源不被非法使用和访问这一问题显得越来越重要。近年来对访问控制的研究已成为计算机科学领域的研究热点。尽管目前基于属性方式的传统访问控制在数字信息系统中有许多应用，但原有授权模型已不能很好地满足版权保护等系统的需求，其局限性主要为：1）许可模型是从系统的角度出发，以基于主体-客体观点的被动安全模型来保护资源；2）授权模型是静态的，在执行任务之前，主体就拥有权限，无法解决在动态分布式系统下数字资源的非法使用问题。针对现有的访问控制模型方面存在的不足，本文提出了一种基于属性RBAC及带委托性质的使用控制模型的新型动态许可授权模型(即Extended Usage Control，EUCON)。在EUCON框架模型的基础上，基于区间时序逻辑语言(即Internal Temporal Logic, ITL)建立了EUCON的动态逻辑描述模型。为使EUCON委托机制能够支持更灵活的细粒度委托，本文提出了一种新型的基于映射机制的细粒度RBAC委托模型(即Fine-GrainedRole Delegation Model Based Permission Mapping Mechanism，RDBMPM)。角色作为EUCON模型的一个组成部分，解决好基于角色层次来进行权限管理所存在的问题，将为EUCON模型的权限管理奠定基础。针对在大型的分布式应用系统中，角色层次已不能很好地反映角色的组织结构，本文在对角色的权限类型与角色之间的关系进行重新分析的基础上，引出了原子角色的概念，提出了基于原子角色授权许可模型(即Atom-Role-Based Access Control，ATRBAC)，从而大大增强了EUCON权限管理系统的灵活性和安全性。EUCON模型继承了UCON模型的优点并在属性、角色、委托等方面对UCON模型进行了扩展和完善，这使得EUCON模型能够提供更灵活的访问控制。最后，本文给出了EUCON模型的一个应用实例：提出了一种基于EUCON的数字版权保护系统EUDRMPS(即Extended Usge Control for DRM Protection System)，体现了模型的实用价值。更多还原

【Abstract】 With the development of network technology and the growing Internet applications, theissue of how to ensure network resources from unauthorized use and access has becomeincreasingly important. In recent years, research on access control has become a hot field oncomputer science. Although traditional attribute-based access controls have been widely usedin digital information systems, original authorization models can’t meet some systemrequirements well such as copyright protection, and their main faults are as follows: firstly,most of these models are based on the subject-object, which use passive strategies to protectresources from the point of systems; secondly, authorization models are static, subjects canhave privileges before the implementation of tasks, which can’t well solve the problem ofillegal use of digital resources in the dynamic, distributed system.Against the deficiencies of existing access control models, this paper proposed a modelcalled EUCON: based attribute-RBAC with character of delegation usage control model. Andthen, in order to formally describe the EUCON core model, a EUCON logic model based onInternal Temporal Logic (ITL) was proposed.Thirdly, for the purpose of ensuring thatEUCON model supports fine-grained delegation, this paper proposed a RDBMPM model: afine-grained role delegation model based on permission mapping mechanism. Role as a partof EUCON model, which can well solve the problem of rights management based on rolehierarchy, will lay the foundation for the model’s rights management. Role hierarchy can’twell reflect the roles’ organization structure in the large-scale distributed applicationenvironments. Against above fault, this paper, by studing the role relationship and theirtransformation method, proposed the concept of atom role and constructed a newatom-role-based access control model, called ATRBAC, which enhances the flexibility andsecurity of EUCON model (or rights management system).EUCON model, which can provide more flexible access control, has inherited theadvantages of UCON model and expanded it in the aspects of attribute, role and delegationetc. Lastly, this paper gave an application case of EUCON model: extended usage control forDRM protection system (called EUDRMPS), which reflects the model’s utility value.更多还原