【作者】 刘婷婷；

【导师】 张友良；

【作者基本信息】 南京理工大学 ， 机械制造及其自动化， 2004， 博士

【摘要】 随着信息、通信、计算机网络技术的发展，制造业正经历着一场深刻的变革：网络化制造正逐渐取代传统的制造方式成为新一代的制造模式。网络化制造系统是网络化制造模式的实现系统，它是一个由多种、异构、分布式的制造资源，以一定互联方式，利用计算机网络组成的、开放式的、多平台的、相互协作的、能及时灵活地响应客户需求变化的制造系统。制造企业的所有数据都要在上述系统中存储、发送、转发、接收、融合、再生，这个过程涉及到大量需要保密的企业知识产权的信息。因此，保证系统的信息安仝是网络化制造系统应用推广的基本前提，本文研究的目的在于实现网络化制造系统的信息安全。 网络化制造系统的复杂特性对其安全体系结构的构建提出了要求，本文通过深入分析安全体系结构的通用需求及网络化制造系统复杂特性对安全体系结构的特殊需求，提出了一个适用于网络化制造系统的安全体系结构，指出访问控制技术是信息安全关键单元技术之一。 访问控制模型是访问控制实现的基础。本文在分析网络化制造系统与访问控制相关的系统特点及现有访问控制模型存在问题的基础上，提出了一个适用于网络化制造系统的访问控制模型—语义驱动访问控制模型(SDACM)。该模型能够解决现有访问控制模型存在的问题：能够同时支持工作流管理和非流程相关的系统资源的访问控制，能够支持自主的主体角色授权，能够支持系统的动态性、协作性，能够降低信息泄漏风险。 访问控制的约束处理问题和一致性维护是访问控制模型必须解决的关键问题。本文应用面向对象方法建立了SDACM的对象模型，清晰地描述了对象之间的关系。在此基础上提出应用混合封装模式对SDACM中的约束进行处理，该方法能够有效地对SDACM中的约束进行管理，避免系统约束分布到所有对象中带来的存储重复和不一致性的发生，有效地降低了集中管理的约束量；针对一致性维护问题，提出了通用一致性维护原则及实现算法，有效地降低了安全策略一致性维护代价；提出依据策略冲突映射的实际世界含义来进行策略冲突的消解； 访问控制框架和访问控制机制是访问控制模型在系统中的实现。在安全体系结构及访问控制模型的指导下，本文提出了一个适用于网络化制造系统的访问控制框架，给出了访问控制实现流程，并依据网络化制造系统的域分布特性提出了基于代理的身份认证方案和访问控制配置方案，依据访问控制模型提出了全部访问控制策略的配置摘要博士论文方案。 为了在系统中应用SDACM，本文设计了访问控制关系数据库表集，进行了访问控制策略关系模型到对象模型的转换实验，提出了从关系数据库表获取角色图的方法;在分析了现有的协同应用存在问题的基础上，设计了一个面向网络化协同工作系统的实时协作工具CTeCWS，提出了访问控制策略转移方法，提出了一个协作小组公有过滤策略的计算算法和一个协作小组成员过滤策略的计算算法。 在上述研究的基础上，本文阐述了实现环境及实现方法，并在此基础上进行了系统开发。关键词:网络化制造，安全体系结构，访问控制更多还原

【Abstract】 With the development of information technology and network technology, networked manufacturing is becoming a new paradigm for manufacturing industry. Networked manufacturing system is an open, heterogeneous, cooperation-supported, agile system for networked manufacturing which is composed of various, distributed manufacturing resources through network. All information of an enterprise needs to store, send, transfer, integrate and reproduce in the system in which a great deal of intellectual asset requires protection. Therefore information security is the precondition for applying and extending the system. The object of this paper is to realize information security for networked manufacturing system.Security architecture should satisfy the requirements of complicated system features. Through analyzing the common requirements of security architecture and the requirements of complicated system features, a new security architecture is established in this paper which can meet the needs of networked manufacturing system.Access control model is the foundation of the realization of access control in the system. Based on analyzing system features related to access control and problems existing in the system, an access control model named semantic driven access control model (SDACM) is proposed which can control the data in workflow and those data unrelated to workflow at the same time. SDACM also can support self-help authorization under the control of security manager and solute the problem induced by dynamic characteristics and cooperation.Constraints and policy consistency are two key problems in SDACM. In order to study these problems, object model of SDACM is established in this paper describing components in SDACM clearly. Based on the object model, a new method is suggested to support constraint management which can avoid repeated storing and reduce the system constraint number. Also general principles and an arithmetic are put forward to decrease the cost for consistency maintenance.Architecture and mechanism for access control are the realization of access control model in system. According to the direction of security architecture and SDACM, an access control architecture is established and its implementation procedure is given out. Under the direction of security architecture, an agent-based authentication scheme and a scheme for subject configuration are proposed. The scheme for all policy configuration in access control module is also given out.In order to apply SDACM in networked manufacturing system, tables in relational database for policy storing is established, an experiment was carried out to transfer data in relational database to data organized in object and method is given out to draw role graph which gets data from relational database. Moreover, a cooperative tool for networked manufacturing system is designed based on the analysis of existing problems. Methods for policy transfer, arithmetic for public filtering rules of cooperative group and arithmetic for member filtering rules in cooperative group are all presented in this paper.We have developed the access control module in prototyping system in which theories, methods and arithmetic researched in this dissertation are used. In order to describe clearly, prototyping system and methods to develop the system are also introduced.更多还原