基于关系的访问控制模型的实现方法研究

发布时间：2018-05-31 15:12

本文选题：访问控制模型 + RelBAC　；参考：《吉林大学》2017年硕士论文

【摘要】：基于关系的访问控制(Relation-based Access Control,以下简称Rel BAC)模型最初于2008年由F.Giunchiglia等人提出,相比传统的访问控制模型(如RBAC),它将授权独立地视为与主体、客体同等地位的元素,从而可以灵活的制定和实现访问控制规则。Rel BAC运用结构相对简单的轻量级本体直观的展现了模型的各个部分,本体中的概念由形式化的逻辑标签标注,具有准确而严格的访问控制语义。Rel BAC模型简化了访问控制策略的管理,旨在让像大众用户这样的潜在访问控制管理员在缺少安全领域专业背景的前提下来管理他们个人的东西,如博客、照片、邮件等。Rel BAC模型凭借其逻辑背景和大众化的特点近年来越来越受到关注,但该模型在实际应用中的瓶颈也凸显出来。在Rel BAC模型中,一个授权被形式化为一个描述逻辑(DL)角色,权限的检查则由描述逻辑的推理服务来完成。然而,Rel BAC模型由描述逻辑ALCQIBO形式化地表示,该逻辑的推理复杂度为NExp Time-Complete,当前并没有推理机能够推理该逻辑的知识库。因此,本文提出两种知识库转换方法,弥补了Rel BAC模型真正走出实验室的现实基础。决定Rel BAC模型推理复杂度极高的核心因素是其“完全访问控制(TAC)”策略,本文提出的第一种转换方法即在不改变ALCQIBO语义的前提下,将DL描述的TAC策略转化为用语义网规则语言(SWRL)描述,从而使Rel BAC知识库转化为由ALCQIO+SWRL共同形式化表示,这使得当下主流的DL推理机能够为转换后的知识库提供有效的推理服务。为了验证该方法的可行性,本文建立了一系列转换后的标准测试本体,通过系统的实验数据给出了知识库结构对推理效率的影响。测试结果表明本方法使得主流推理机能够推理复杂度极高的Rel BAC知识库。本文提出的第二种转换方法即将Rel BAC模型的描述逻辑知识库完全编译为命题逻辑知识库,借助强大的命题逻辑推理机提供访问控制推理服务。基于描述逻辑的Rel BAC知识库中的全部ABox断言通过“个体传播”算法均可被映射到基于命题逻辑的Rel BAC知识库中,对描述逻辑知识库中授权的查询则被编译为命题逻辑知识库中的可满足性(SAT)检测。文中亦给出该编译过程的有效性证明和基于闭世界假设的完备性证明。本文通过以上两种知识库转换方法实现了Rel BAC模型,为该模型的实际应用创造了理论和现实条件。
[Abstract]:The Relation-based Access Control (Rel BACL) model was first proposed by F.Giunchiglia et al in 2008. Compared with the traditional access control model (such as RBAC), it regards authorization as an element of the same status as subject and object. Thus, the access control rule. Rel BAC can be flexibly formulated and implemented. The lightweight ontology with relatively simple structure can show the various parts of the model intuitively. The concepts in the ontology are annotated by the formal logic label. The accurate and strict access control semantics. Rel BAC model simplifies the administration of access control policies, and aims to allow potential access control administrators such as mass users to manage their personal affairs without a professional background in the security domain. In recent years, blog, photo, email and so on. Rel BAC model has attracted more and more attention because of its logical background and popular characteristics, but the bottleneck of the model in practical application has also been highlighted. In the Rel BAC model, an authorization is formalized as a description logic (DLL) role, and the authorization checking is performed by the reasoning service of the description logic. However, the model of rel BAC is formally represented by the description logic ALCQIBO. The reasoning complexity of the logic is NExp Time-Complete.At present, there is no inference engine that can infer the knowledge base of the logic. Therefore, this paper proposes two knowledge base transformation methods, which make up the practical foundation of Rel BAC model. The core factor that determines the high complexity of Rel BAC model is its "complete access control (TAC)" strategy. The first transformation method proposed in this paper is without changing the semantics of ALCQIBO. The TAC strategy described by DL is transformed into a semantic web rule language (SWRL), so that the Rel BAC knowledge base is transformed into a formal representation by ALCQIO SWRL, which enables the current mainstream DL inference engine to provide an effective reasoning service for the transformed knowledge base. In order to verify the feasibility of the method, a series of transformed standard test ontology is established in this paper, and the effect of knowledge base structure on reasoning efficiency is given through the experimental data of the system. The test results show that this method enables the mainstream reasoning machine to reason the Rel BAC knowledge base with high complexity. The second transformation method proposed in this paper is that the description logic knowledge base of Rel BAC model is compiled into the proposition logic knowledge base, and the access control reasoning service is provided by the powerful propositional logic inference machine. All ABox assertions in the Rel BAC knowledge base based on description logic can be mapped to the Rel BAC knowledge base based on propositional logic through the "individual propagation" algorithm. The query authorized in the description logic knowledge base is compiled to detect satisfiability in the proposition logic knowledge base. The validity proof and the completeness proof based on the closed world hypothesis are also given. In this paper, the Rel BAC model is implemented by the above two knowledge base transformation methods, which creates theoretical and practical conditions for the practical application of the model.
【学位授予单位】：吉林大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】