| 摘要: |
| 角色委托是RBAC模型需要支持的一种重要安全策略.它的主要思想是系统中的主动实体将角色委托给其他主动实体,以便以前者名义执行特定的工作.角色委托者要对委托角色的使用负责,所以对委托角色进行使用限制是整个模型的关键组成部分.目前已有一些模型扩展了RBAC模型以支持角色委托,但是这些模型对委托限制的支持非常有限.提出了角色委托限制的需求,包括临时性限制、常规角色关联性限制、部分性限制和传播限制.并且,给出了一个支持临时性限制和常规角色关联性限制的基于角色的委托模型.给出模型的形式化描述,为模型在实际环境中的应用奠定了基础. |
| 关键词: 信息安全 访问控制 委托 限制 委托票据 |
| DOI： |
| 分类号: |
| 基金项目:Supported bythe National Natural Science Foundation of China under Grant Nos.60025205,60273027(国家自然科学基金);the National High-Tech Research and Development Plan of China under Grant No.2004AAl47070(国家高技术研究发展计划(863));the National Grand Fundamental Research 973 Program ofChina under Grant No.G1999035802(国家重点基础研究发展规划(973)) |
|
| A Constrained Role-Based Delegation Model |
|
XU Zhen,LI Lan,FENG Deng-Guo
|
| Abstract: |
| Delegation is an important security policy that should be supported by RBAC model. The basic idea of delegation is that some active entity in a system delegates authority to another active entity to carry out some functions on behalf of the former. The grantor of the delegated roles should be responsible for the usage of them, so constraints on the usage of the delegated roles are critical components of the whole delegation model. Currently, there’re some models that extend RBAC model to support role delegation. However, their supports for constraints on the usage of delegated roles are very limited. This paper presents the requirements of role-based delegation, including temporary constraints, regular role dependency constraints, partial delegation constraints and propagation constraints. The former two kinds of constraints are modeled with a formal model – CRDM, which provides the foundation for applications in need of the constrained delegation. |
| Key words: information security access control delegation constraint delegation ticket |
