【作者】 杨秋伟；

【导师】 洪帆；

【作者基本信息】 华中科技大学 ， 信息安全， 2007， 博士

【摘要】 随着网络技术的发展和分布式技术的广泛应用,地域分散的多个组织通过Internet动态结盟并实现互操作已成为目前的研究热点。然而,在这些跨越多个管理域之间的互操作过程中,对资源访问权限的控制依旧是计算机系统安全的关键性问题。访问控制是控制资源访问和保护资源的重要措施,授权管理是访问控制的核心和关键技术。尽管诸多学者对授权管理开展了大量的研究工作,取得了丰硕的成果。但仍存在一些即待解决问题,值得进一步的深入研究。在单个管理域环境下,基于角色的访问控制作为传统访问控制模型的替代者,得到了广泛的应用。但是,在基于角色访问控制管理模型的各种指派中,可能存在非信任主体执行非法的管理操作,使得非信任主体取得了合法权限。可见,权限泄露问题依然是RBAC管理模型中主要的安全问题。针对上述问题,提出了一种新的关于模型安全性的分析方法,运用状态变换系统定义RBAC管理模型,将系统安全策略以安全查询方式给出,并给出了RBAC管理模型安全性的定义。基于ARBAC97的PRA97模型,将安全查询分类为必然性安全查询和可能性安全查询,不仅分析了权限泄露问题,而且分析了权限可用性的安全问题。对比其他学者已做的安全性分析,证明了必然性安全查询和与状态无关的可能性安全查询能在多项式时间内被有效解决,给出了满足NP-完全问题的可能性安全查询的条件,而一般的可能性安全查询是不可判定的。自动信任协商(Automated Trust Negotiation,简称ATN)的目的是在陌生实体之间通过交替的披露信任证,从而建立信任关系。但是,在现有的研究中,都没有考虑到协商过程中主体的自主性和交互性,并且缺乏对协商过程约束条件的描述。通过分析了信任协商系统中主体的行为,并在此基础上形式化定义了协商模式。提出了扩展的一阶时态逻辑来定义信任协商系统的抽象模型,分析了模型的语法和语义。分析了已有信任协商研究的不足,通过具体的应用需求提出并形式化定义了信任协商系统中的职责行为和约束的概念。此外,扩展了Ack策略,讨论了信任协商过程中的敏感信息保护问题,对比其它协商过程中仅仅披露属性证书和访问控制策略的信任协商模型,该模型不仅刻画了协商实体之间的交互性,而且也刻画了授权操作的自主性。在现有自动信任协商系统中,主体拥有的不同属性之间可能存在某种关联,其中某些属性的披露会导致其他敏感信息的泄露,即存在着推理攻击。在已有的相关研究中,并没有对ATN推理攻击给出有效的防御方案,敏感信息泄露问题依然存在。针对上述问题,分析了属性之间的关联特性,提出了隐私属性敏感强度的概念,并给出了敏感强度偏序关系的形式化定义。基于敏感强度偏序关系提出了ATN层次化模型,该模型不仅反映了主体与属性、属性与保护策略之间的关联,而且反映了不同属性之间的线性关系。此外,重点分析了自动信任协商系统中的几类推理攻击,并给出了相应的防御方案,这些防御方案安全性也得到了详细分析。在现有的ATN研究中,都没有对ATN抽象模型严格的形式化定义,也没有引入时间概念,因而没有严格的形式化模型来刻画ATN的处理过程,并且没有考虑随时间变化而引起模型的动态变化,特别是存在着DoS攻击。针对上述问题,提出了ATN抽象模型的基本组件,引入状态变换系统定义ATN抽象模型.在此形式化基础上,对ATN做时间特性上的扩展,分析和讨论了ATN的时间语义。构造一个带时间特性的状态变化系统来描述扩展了的ATN,能够有效的抵御DoS攻击。最后运用新的安全性分析方法对ATN中安全策略的可满足性进行了分析。授权管理是动态结盟系统间协同和资源共享的重要前提。现有的研究中,基于主观信任的授权方式是高效、流行的方法之一。然而,仅仅基于信任的授权管理是不充分的。例如,某个实体能被信任从事技术任务,但不能被信任从事管理工作,在层次化企业结构中,高级管理人员的信任度高于专业技术人员,但高级管理人员成功完成技术任务的可能性低于专业技术人员。在此情况下,成功完成指定任务的可能性可以用风险来描述。虽然也有部分学者在已有的信任模型中引入了风险的概念,但是它们不具备丰富的表达能力,模型相对简单。针对上述问题,提出了授权安全风险的概念,用它来描述安全目标与实际出现的结果之间存在的距离。在此基础上,引入信任-风险联合评估机制,运用模糊集合理论对联合评估模型进行建模,并给出了实体间信任-风险联合关系的推导规则。基于信任-风险联合评估机制定义了授权管理模型,并分析了授权管理中的一致性证明问题和职责分离问题。更多还原

【Abstract】 With the rapid development of computer science and network, there is an urgent need for coordinating and resource sharing in open networks. Whereas, controlling on privileges for accessing resourse is still a crucial aspect for systemic security. Authorization management is the core of access control. Many researchers do much work on authorization management, and obtain great achievement. However, with the development of computer network and application, some issues on authorization management are not resolved effectively. It is necessary to do further research on these issues.In single administrative domain, role-based access control is widely used. However, in the administration model for RBAC, the assignment component maybe still induce leakage of privileges due to illegal operation executed by un-trusted subject. Systemic security strategy is described by security query in administrative model of RBAC. According to the definition of state-transition system, the security analysis is defined and executed on Turing machine. Security query is classified by necessity and possibility. As a result, necessary security query and possible security query independent of status can be resolved in polynomial time, and the conditions under which possible security query is NP-complete problem are presented, but general possible security query is un-decidable.Automate trust negotiation is a method to build the trust relationship between the strangers through iterative and bilateral disclosure of credentials. We analysis abstract action in automated trust negotiation and define pattern of negotiation, then propose abstract model of trust negotiation based on first-order temporal logic. The syntax and semantic meaning are presented. In addition, we analyses disadvantage of existing research in trust negotiation, and then we give the definition of obligation action and constrain. According to the definition of state-transition system, an abstract model is proposed, which depicts not only the alternation but also the autonomy. Finally, we extend the Ack policy to discuss the problem of protecting sensitive information.In ATN, the attributes owned by principles are always relevant each other, so disclosing some attributes maybe induce leakage of sensitive information, namely inference attack. We give the definition and partial order of sensitivity intensity of private attribute, then an abstract automated trust negotiation model is proposed, which depicts relevancy not only between principles and attributes, but also between policies and attributes. As a result, several inference attacks in automated trust negotiation are discussed, then defense scheme and security analysis are presented.In recent research on ATN, the main work focuses on some aspects, which have nothing to do with the time character in recent research, without reasonable schedule scheme of ATN session and existing denial of service attack. The components of ATN are proposed and an abstract ATN model is described with state-transition system. The security policies are extended so that it can describe the time character. A state-transition system with time character is constructed to simulate ATN. The satiability of security policies in ATN is discussed.Authorization management is important precondition and foundation for coordinating and resource sharing in open networks. Considering uncertainty of authorization and analyzing deficiency of authorization model only based on trust or risk, we proposes joint trust-risk evaluation and build the model based on fuzzy set theory, finally derivation principle and constrain principle of joint trust-risk relationships are presented. The authorization management model is defined based on joint trust-risk evaluation, proof of compliance and separation of duty are analyzed. The proposed model depicts not only trust relationship between principals, but also security problem of authorization.更多还原