普适模糊访问控制策略描述语言研究

【作者】 吴茜；

【导师】 王小明；

【作者基本信息】 陕西师范大学 ， 计算机软件与理论， 2008， 硕士

【摘要】 Mark Weiser于1991年提出普适计算的思想。近年来,随着无线网络、分布式计算利移动设备的发展,普适计算作为新的计算模式,已经受到工业界和学术界的广泛关注。但是实现普适计算的分布、异构、模糊、动态等特点仍需要解决许多关键理论和技术,其中一个重要问题就是如何保证普适计算的安全性。访问控制依据预先定义的授权策略授予主体访问客体的权限,并控制主体使用权限的过程,实现系统资源的有权访问,防止非授权的信息泄露,是确保计算系统安全的核心技术之一。目前已存在的访问控制策略有许多,包括自主访问控制、强制访问控制和基于角色的访问控制等。由于普适计算的访问控制具有高度的模糊不确定性和动态自适应性,这使得现有的访问控制策略不能够满足其需要,特别是无法表达普适访问控制策略的模糊不确定性和普适访问控制强度的动态自适应性,而这些恰恰是普适访问控制与传统访问控制间最重要和最根本的区别,是普适访问控制的重要特性。目前针对普适计算的研究主要集中在对其基础设施和应用技术的研究,对普适计算的安全问题讨论较少。为此,本文针对普适访问控制的模糊不确定性和动态自适应性两大特点,运用区间值模糊集合理论和区间值模糊推理方法,提出一种新的普适访问控制策略描述语言(ubiquitous computing access control policy language,简记为UCACPL),实现普适计算的安全需求。普适访问控制系统与传统的访问控制系统在研究思路和方法上有本质的区别,本文首先给出合理、准确的普适访问控制中各要素的模糊概念及其区间值模糊集,在此基础上,进一步提出一种新的以一阶模糊谓词为基础的区间值模糊产生式规则,作为普适访问控制策略描述语言的语法结构,用于有效刻画普适访问控制策略的模糊不确定性和动态自适应性特征,以实现访问控制策略与安全需求的一致性。同时根据应用需求,本文定义基本的一阶模糊谓词,用来描述复杂的普适访问控制上下文。本文主要内容如下:(1)根据普适计算的特征及区间值模糊集合理论,分析引起普适访问控制模糊不确定性和动态自适应性的原因,给出普适计算访问控制的模糊概念。并建立普适计算访问控制中模糊谓词和模糊量词对应的区间值模糊集合,为普适计算访问控制的研究提供模糊集合理论基础。(2)分析传统的访问控制策略描述语言及其语法结构,比较这些语言的优缺点,掌握策略描述语言的研究内容。在此基础上,根据普适计算访问控制的模糊不确定性和动态自适应性特点,指出普适计算访问控制策略描述语言应满足的条件,定义上下文谓词、基本授权谓词、主、客体关系等谓词,并加入量词、联结词以表示复杂的访问控制策略。进而提出一种新的区间值模糊产生式规则,作为普适访问控制策略描述语言的语法结构。(3)以智能空间的实例——智能教室为应用背景,在Microsoft.NET平台下,使用C#语言对相应理论和方法进行应用研究。本文研究依托普适计算访问控制系列研究课题——陕西省自然科学基金(编号:2006F27),教育部科学研究重点项目(编号:107106),国家自然科学基金(编号:60773224)。更多还原

【Abstract】 Mark Weiser proposed the concept of ubiquitous computing in the year of 1991.With the development of wireless network,distributed computing and mobile devices,ubiquitous computing has been the newest computing paradigm,and been noted in industry and research.However,there is still key theory and technology to solve to realize the characters of distributing,fuzzy and dynamy of ubiquitous computing,and the security of ubiquitous computing has become an important issue. Access Control grants subject to operate on objects based on predefined authorization polices to protect unanthorized information from being leaked.And,it is an essential technology to guarantee the security of the complex system.Now,there are several access control polices,including discretionary access control,mandatory access control,role-based access control,etc.However,due to the characters of fuzzy uncertainty and dynamic adaptability of ubiquitous computing access control,the existed access control polices cannot meet the needs,especially cannot express the fuzzy uncertainty of ubiquitous computing access control polices and the dynamic adaptability of ubiquitous computing access control strength,which are the most important differences between ubiquitous computing access control and the traditional access control.Now,the researches of ubiquitous computing mostly focus on its infrastructures and its applications,there is few research on the security.Thus,based on its characters of fuzzy uncertainty and dynamic adaptability,ubiquitous computing access control policy language is presented using interval-valued fuzzy set theory and interval-valued fuzzy reasoning method to realize the security of ubiquitous computing.There are different ideas and methods between ubiquitous computing access control and traditional access control.Firstly,reasonable and correct fuzzy concepts of elements and the interval-valued fuzzy sets in ubiquitous computing access control are presented.Then based on first order predicate,a new interval-valued fuzzy production rule is presented,which is the syntax of ubiquitous computing policy language.The rule can effectively describe the fuzzy uncertainty and dynamic adaptability of ubiquitous computing access control and keep the consistency between access control policy and security needs.Besides these,according to application needs,some first order fuzzy predicates are defined to describe the complex contexts.The main researches are outlined as follows:(1)Based on the characters of ubiquitous computing and interval-valued fuzzy set theory,the reasons of the fuzzy uncertainty and dynamic self-adaptability are analyzed,the fuzzy concepts of ubiquitous computing access control are proposed.And the fuzzy predicates and the fuzzy quantifiers of ubiquitous computing access control are defined,according to which the interval-valued fuzzy sets are established,which are fuzzy set theory basis of the research of ubiquitous computing access control.(2)The traditional access control policy language and its syntax structures are analyzed;these policy languages are compared in order to understand the content of a policy language.Then,the conditions the ubiquitous computing policy language must satisfy are pointed out.The context predicates,basic authorization predicates and the relationship predicates of subjects and objects are defined,as well as quantifiers and conjunction are defined to express complex access control polices.Furtherly,a new interval-valued fuzzy production rule is proposed as the syntax structure of ubiquitous computing access control policy language.(3)Taking the instance of Smart space—smart classroom as the application background,and in Microsoft.NET platform,using C# language to research related theory and method.This paper is supported by the Natural Science Foundation of Shaanxi Province of China(NO.: 2006F27),the Key Research Project of Ministry of Education of China(NO.:107106),the National Natural Science Foundation of China(NO.:60773224).更多还原