将各种安全功能从上层应用中抽象出来形成一种通用和标准的安全服务,可以简化应用开发的复杂性和增强安全功能的可重用性。论文设计并实现了一个基于XACML的通用分布式访问控制决策中间件UDACD(Universal Distributed Access Control De...将各种安全功能从上层应用中抽象出来形成一种通用和标准的安全服务,可以简化应用开发的复杂性和增强安全功能的可重用性。论文设计并实现了一个基于XACML的通用分布式访问控制决策中间件UDACD(Universal Distributed Access Control Decision),对分布式环境下的访问控制决策过程进行了封装,对外面向各种应用提供通用的决策服务。UDACD支持多种访问控制策略类型和跨管理域的匿名资源访问控制;实现了对策略的缓存和对用户安全属性的两级缓存,显著加快了决策速度。UDACD可以帮助简化策略管理,并提供跨应用的一致策略实施。展开更多
Based on trust measurement, a new cross-domain access control model is proposed to improve the security performance of the cross-domain access control processes. This model integrates the trust management and trusted ...Based on trust measurement, a new cross-domain access control model is proposed to improve the security performance of the cross-domain access control processes. This model integrates the trust management and trusted platform measurement, defines several concepts （user trust degree, platform configuration integrity and intra/inter-domain trust degree） and calculates them with users＇ uniform identity authentication and historical access behavior analysis. Then this model expands the extensible access control markup language （XACML） model by adding inside trust manager point （ITMP） and outside trust manager point （OTMP）, and describes the architectures and workflows of ITMP and OTMP in details. The experimental results show that this model can achieve more fine-grained access control, implement dynamic authorization in a simple way, and improve the security degrees of the cross-domain access control.展开更多
基金国家自然科学基金(the National Natural Science Foundation of China under Grant No.60603017)国家高技术研究发展计划(863)(theNational High-Tech Research and Development Plan of China under Grant No.2006AA01Z454)国家科技支撑计划(No.2006BAH02A02)。
文摘将各种安全功能从上层应用中抽象出来形成一种通用和标准的安全服务,可以简化应用开发的复杂性和增强安全功能的可重用性。论文设计并实现了一个基于XACML的通用分布式访问控制决策中间件UDACD(Universal Distributed Access Control Decision),对分布式环境下的访问控制决策过程进行了封装,对外面向各种应用提供通用的决策服务。UDACD支持多种访问控制策略类型和跨管理域的匿名资源访问控制;实现了对策略的缓存和对用户安全属性的两级缓存,显著加快了决策速度。UDACD可以帮助简化策略管理,并提供跨应用的一致策略实施。
基金Supported by the National Key Technology Support Program of China(2013BAK07B04)the Natural Science Foundation of Hebei Province(F2014201152)
文摘Based on trust measurement, a new cross-domain access control model is proposed to improve the security performance of the cross-domain access control processes. This model integrates the trust management and trusted platform measurement, defines several concepts （user trust degree, platform configuration integrity and intra/inter-domain trust degree） and calculates them with users＇ uniform identity authentication and historical access behavior analysis. Then this model expands the extensible access control markup language （XACML） model by adding inside trust manager point （ITMP） and outside trust manager point （OTMP）, and describes the architectures and workflows of ITMP and OTMP in details. The experimental results show that this model can achieve more fine-grained access control, implement dynamic authorization in a simple way, and improve the security degrees of the cross-domain access control.
