随着分布式安全系统研究的不断深入和发展,基于策略的体系结构已经逐步成为了访问控制系统中的一种主流方法。然而这些策略的定义均建立在特定的语言基础上,如何在异构的系统间进行集成尚缺乏有效的机制。本文提出了一种基于本体的访问控制策略定义机制——OntoRBAC——它完全支持了RBAC96模型,利用本体这个工具,能够为访问控制策略的制定提供更精确、更强大的描述能力,并且可以实现从语义层次上对不同策略的集成。而借助于SWRL(Semantic Web Rule Language),我们定义了多条适用于OntoRBAC的规则来进行对访问控制决策的推理。最后,介绍了这个系统的实现框架。
Authorization management is important precondition and foundation for coordinating and resource sharing in open networks. Re- cently, authorization based on trust is widely used whereby access rights to shared resource are granted on the basis of their trust relation in distributed environment. Nevertheless, dynamic change of the status of credential and chain of trust induces to uncertainty of trust relation. Considering uncer- tainty of authorization and analyzing deficiency of authorization model only based on trust, we proposes joint trust-risk evaluation and build the model based on fuzzy set theory, and make use of the membership grade of fuzzy set to express joint trust-risk relation. Finally, derivation principle and constraint principle of joint trust-risk relationships are presented. The authorization management model is defined based on joint trust-risk evaluation, proof of compliance and separation of duty are analyzed. The proposed model depicts not only trust relationship between principals, but also security problem of authorization.
