地理空间数据访问控制模型研究

发布时间：2018-10-23 09:02

【摘要】：随着物联网、普适计算、移动互联等技术的不断更新,地理空间数据的获取与共享日益便利,但地理空间数据安全问题也随之凸显。虽然传统信息领域在计算机诞生之初就开始了对信息安全访问控制的研究,有着丰富、成熟的理论与技术,但由于地理空间数据的特殊性,如多尺度、空间关系、属性等特征,传统的访问控制理论与技术无法满足地理空间数据访问控制的特殊需求,因此需要针对地理空间数据的特征,研究地理空间数据访问控制模型理论及其实现技术。本文通过深入研究地理空间数据的特征及传统访问控制理论与技术,分别针对地理空间数据文件及其数据库,提出了相应的访问控制模型,并构建高效的访问控制实现机制。主要内容包括：(1)论述了地理空间数据的相关技术以及常用的访问控制模型,分析地理空间数据特征及共享特点,分别指出地理空间数据文件及数据库在共享中存在的安全威胁,并针对各个安全威胁因素,结合地理空间数据的特征以及访问控制的基本原则,提出了地理空间数据访问控制应对策略,为后续地理空间数据文件与数据库访问控制模型的建立与实施提供理论与技术支持。(2)针对现有地理空间数据文件访问控制存在控制形式单一、控制技术具有局限性等问题,结合地理空间数据的多尺度特征与属性特征,通过扩展元属性、引入加解密机制,提出了一种基于属性的访问控制模型—-GDF-ABAC模型。该模型支持多种粒度的访问控制,具有良好的灵活性与可扩展性。然后,依据地理空间数据文件在多域环境中的使用特点,构建了其在多域环境中的框架模型。基于分级管理、逐级控制的思想,设置属性与策略管理规则,提出了框架模型的实现机制,保证了地理空间数据文件在多域环境下的安全性与可控性。在此基础上,采用过滤驱动技术,实现了多域环境下Shapefile格式数据的跨应用软件平台、要素级细粒度访问控制。(3)针对现有访问控制模型无法满足地理空间数据库访问控制实际需求的问题,提出了一种基于多元地理空间数据特征约束的RBAC模型—一MFC-RBAC模型。该模型在访问主体中,扩展了时空约束,增强了模型的安全性,并支持移动端的访问控制,并在权限中,扩展了时空尺度、空间关系以及属性等多元特征约束,可支持图库、数据集、数据层以及要素等级别的多种粒度访问控制,提高了模型的灵活性,弥补了现有访问控制模型的不足,具有良好的地理空间数据访问控制表达能力。通过引入有效权限集、设定多元特征约束判定优先级,优化了模型的权限管理及判定过程,提高了访问控制的效率,并通过形式化定义,给出了具体的实现算法。在此基础上,采用中间件的方式对MFC-RBAC模型进行了实现,验证了模型的有效性与实用性。(4)针对海量地理空间数据库访问控制的效率问题,构建了由时空三维R树索引与传统R树索引所组成的双级空间索引——SR+R-Tree,并将授权信息嵌入到该双级空间索引中,提出了面向MFC-RBAC模型高效实现的双级授权空间索引机制—-DART授权模型,并给出了相应的实现算法。该模型不仅将检索与策略判定过程合二为一,而且在策略判定时,无需进行复杂的空间运算,只需比较角色、操作、统计信息以及属性等非空间约束,简化了策略判定过程,提高了地理空间数据库的访问控制效率。特别是对于栅格数据的细粒度访问控制,使其摆脱了对矢量数据的依赖,同时支持矢量与栅格数据的访问控制。
[Abstract]:With the continuous updating of Internet of Things, application computing, mobile interconnection and so on, the acquisition and sharing of geospatial data is becoming more and more convenient, but the problem of data security of geospatial data is also highlighted. Although the traditional information field has started the research on information security access control at the beginning of the computer's birth, it has rich and mature theory and technology, but because of the particularity of geospatial data, such as multi-scale, space relation, attribute, etc., Traditional access control theory and technology can not meet the special needs of geospatial data access control, so it is necessary to study the theory of geographic spatial data access control model and its implementation technology for the characteristics of geospatial data. By studying the characteristics of geospatial data and the traditional access control theory and technology, this paper puts forward the corresponding access control model for geospatial data file and its database, and constructs an efficient access control implementation mechanism. The main contents include: (1) discussing the related technologies of geospatial data and common access control models, analyzing the characteristics of geospatial data and sharing characteristics, and respectively pointing out the security threats existing in the sharing of geospatial data files and databases, Based on the characteristics of geospatial data and the basic principles of access control, this paper puts forward the strategy of access control for geospatial data, and provides theoretical and technical support for the establishment and implementation of the database access control model. (2) aiming at the problems of single control mode, limitation and the like of the existing control mode of access control of the existing geospatial data file, combining the multi-scale feature and the attribute characteristics of the geospatial data, and introducing the encryption and decryption mechanism through the expansion element attribute, An attribute-based access control model XE-GDF-ABAC model is proposed. The model supports multi-granularity access control with good flexibility and scalability. Then, according to the use characteristics of geospatial data file in multi-domain environment, the frame model in multi-domain environment is constructed. In this paper, the implementation mechanism of framework model is put forward based on the idea, setting attribute and policy management rule of level-level control, and the security and controllability of geospatial data files in multi-domain environment are guaranteed. On the basis of this, adopting the filter driving technology, the cross-application software platform of Shapefile format data under the multi-domain environment is realized, and the fine-grained access control of the element level is realized. (3) Aiming at the problem that the existing access control model can not satisfy the actual demand of the access control of the geographical space database, a RBAC model based on multivariate geospatial data feature constraint is proposed in this paper, which is an MFC-RBAC model. in the access main body, the model expands the space-time constraint, enhances the security of the model and supports the access control of the mobile terminal, A plurality of granularity access control of the data layer and the element level improves the flexibility of the model, overcomes the defects of the existing access control model and has good geographic spatial data access control expression capacity. By introducing the effective permission set, the priority of the multi-feature constraint determination is set, the authority management and decision process of the model are optimized, the efficiency of access control is improved, and a specific implementation algorithm is provided through the formal definition. On this basis, the MFC-RBAC model is implemented in the way of middleware, and the validity and practicability of the model are verified. (4) Aiming at the efficiency problem of access control of massive geospatial database, a double-level spatial index _ SR + R-Tree composed of space-time three-dimensional R-tree index and traditional R-tree index is constructed, and authorization information is embedded into the double-level spatial index. Based on MFC-RBAC model, this paper proposes a two-level authorization space index mechanism Model-DART authorization model, and gives the corresponding implementation algorithm. The model not only integrates the retrieval and the policy decision process, but also does not need to carry out complicated spatial operation when the strategy is judged, only needs to compare the non-space constraints such as roles, operations, statistics information and attributes, simplifies the policy decision process, and the access control efficiency of the geographical space database is improved. Especially for the fine-grained access control of grid data, it can get rid of the dependence of vector data and support vector and grid data access control.
【学位授予单位】：南京师范大学
【学位级别】：博士
【学位授予年份】：2015
【分类号】：P208

【相似文献】