组合服务授权策略冲突检测方法的研究与实现

发布时间：2018-11-08 09:03

【摘要】：在组合服务被广泛使用的环境下,访问控制技术是保证组合服务安全的关键技术,而授权策略是访问控制技术中至关重要的元素,对于授权策略的正确制定是保障访问控制体系正常运行的前提。本文通过CWS-RBAC模型来实现用户与组合Web服务之间的访问控制,在该CWS-RBAC模型中,用户通过主体角色来反映用户在账号系统中的权限等级,组合Web服务通过客体角色来进行访问调用,授权策略通过描述主体角色和客体角色之间的授权关系来进行用户与服务之间的授权管理。在该模型中,系统管理员通过制定一条授权策略来准许或者否定一个主体角色对于客体角色的授权请求。由于组合服务环境下服务种类繁多,管理员在海量组合服务的环境中可能会面临大规模的授权策略,添加的新的授权策略有可能与已有的授权策略冲突,并因此导致授权混乱和权限泄露。授权策略冲突检测由此成为组合Web服务环境下保障正常授权的关键环节。为了检测CWS-RBAC模型中的授权策略冲突,本文详细分析了CWS-RBAC模型中授权策略的特征,包括主体角色结构导致的授权传播,客体角色结构导致的授权扩散,以及组合Web服务工作流导致的授权泄露。在该授权特征分析的基础上,本文根据主体角色等级结构提出了主体角色传播冲突检测方法,根据客体角色组合结构提出了客体角色组合冲突检测方法以及根据组合Web服务工作流提出了上下文冲突检测方法,并基于OAuth2.0协议设计了具备授权管理功能的授权策略冲突检测原型系统,通过生成随机策略并进行授权冲突检测的方式来验证授权策略冲突检测方法的有效性。
[Abstract]:In the environment where composite services are widely used, access control technology is the key technology to ensure the security of composite services, and authorization policy is an essential element of access control technology. The correct formulation of authorization policy is the premise to ensure the normal operation of access control system. In this paper, the access control between user and composition Web service is realized by CWS-RBAC model. In this CWS-RBAC model, the user reflects the user's privilege level in the account system through the principal role. Composite Web services are accessed by object roles, and authorization policies are used to manage authorization between users and services by describing the authorization relationship between subject roles and object roles. In this model, the system administrator formulates an authorization policy to grant or deny a subject role's authorization request to the object role. Because there are many kinds of services in composite service environment, administrators may face large-scale authorization policy in the environment of massive composition services, and the added new authorization policy may conflict with the existing authorization policy. And thus lead to authorization confusion and authority leaks. Therefore, the conflict detection of authorization policy becomes the key link to guarantee the normal authorization in the composite Web service environment. In order to detect the conflict of authorization policy in CWS-RBAC model, this paper analyzes the characteristics of authorization policy in CWS-RBAC model in detail, including authorization propagation caused by principal role structure and authorization diffusion caused by object role structure. And composition of Web services workflow resulting in authorization leaks. Based on the analysis of the authorization features, this paper proposes a method of conflict detection based on the hierarchical structure of the principal role. According to the object role composition structure, the object role combination conflict detection method and the context conflict detection method based on the composition Web service workflow are proposed. An authorization policy conflict detection prototype system with authorization management function is designed based on OAuth2.0 protocol. The validity of authorization policy conflict detection method is verified by generating random policies and detecting authorization conflicts.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】