【作者】 杭园园；

【导师】 钱雪忠；

【作者基本信息】 江南大学 ， 计算机应用技术， 2007， 硕士

【副题名】面向服务基于角色与任务的访问控制技术应用研究

【摘要】 随着信息技术的发展,面向服务的体系结构由于其开发效率高、响应快、费用低等优点,应用范围越来越广泛。服务合成作为面向服务体系结构的重要实现方式,也倍受关注。但是由于面向服务的体系结构具有松散耦合性和计算动态性等特点,造成其安全管理更为复杂。访问控制作为安全技术中的一项重要技术,面临着巨大的挑战。所以对面向服务体系结构的访问控制的研究,以及在服务合成环境下的访问控制的研究都显得尤为重要。文章首先回顾了访问控制技术的发展,介绍了几种主要的访问控制模型及其各自的特点,自主访问控制模型DAC由于访问控制的自主性,难以对赋予出去的访问权限进行控制;强制访问控制模型MAC严格按照安全等级进行访问控制,虽能提供较高水平的安全保护,但缺乏灵活性;基于角色的访问控制模型RBAC的授权虽相对灵活,容易进行权限管理,但不能实现动态权限回收;基于任务的访问控制模型TBAC虽能提供动态的安全管理,满足任务的完整性约束,但是TBAC中的受托人集实质仍然是用户的集合,没有对角色授权的概念进行过多的描述。为了克服传统访问控制模型存在的缺陷,本文结合RBAC和TBAC的特点,设计了一种增强权限约束的面向服务的访问控制模型PS-TRBAC。在这个模型中,通过引入服务的概念,加强了对动态服务架构的描述能力;引入增强权限集将任务与权限绑定在一起,来简化安全管理中的授权管理和约束管理;将RBAC与TBAC结合,可以保证授权有效时间与任务执行时间尽可能同步,保证最小特权原则和动态职责分离原则。通过对实际任务和服务状态的管理,有效地加强访问控制的灵活性和系统的安全性,能够很好的应用于面向服务的架构体系。其次,文章还分析了PS-TRBAC模型在服务合成中的作用,介绍了如何使用业务流程执行语言BPEL描述PS-TRBAC,解决服务合成的访问控制问题。最后在实现部分设计并实现了一个基于PS-TRBAC的原型系统,其中包括系统框架的设计,基于UML的建模,系统基本模块的设计和数据库的设计。更多还原

【Abstract】 With the develop of information technology, service-oriented architecture (SOA) is used more and more as its excellences such as high efficiency, fast response, low cost and so on. As an important way to implement SOA, service composition is attached more importance to. But SOA will cause the complexity of security management due to its loose-couple and dynamic characteristics. As one of the most important security technology, access control is facing tremendous challenges. So it is very important to do research on services-oriented access control and even service composition oriented access control.In this paper, first, the development of access control technology is reviewed, some access control model and its characteristics are introduced. The discretionary access control model is hard to control the assigned permissions as its independence characteristic. The mandatory access control model do access control according to security rank strictly, although it can provide higher level safeguard protection, it is short of flexibility. The role-based access control model is flexible and easy in permission management, but it can’t revoke dynamic permissions. The task-based access control model can provide dynamic security management, can satisfy the integrality constraints of task, but the trustee-set in TBAC is essentially users, not roles.In order to get over the shortage in traditional access control model, a services-oriented role and task-based access control supported by enhanced permission constraints PS-TRBAC is proposed. In the model, the notion of services is used to describe dynamic serviced-oriented architecture. The enhanced permission-set which binds task and permission is used to make the authorization and constraints easy in security management. Combine the RBAC and TBAC, the model can ensure that the authorization valid time is synchronized with the execution time as soon as possible, the least permission principle and dynamic duty separation principle. It can provide flexibility in access control system and enhance system security based on the state of task and service. The model can be applied to SOA security system more favorable.Next, the effect of PS-TRBAC in services composition is analyzed, how to use Business Process Execution Language(BPEL) to describe PS-TRBAC is introduced, it can solve the access control in service composition environment.In the implement section in this paper, a prototype system based on PS-TRBAC is designed and implemented, include the design of system architecture, the modeling based The Unified Modeling Language (UML), and the design of basic module and database.更多还原