跨域授权管理系统的研究与实现
|
摘要
随着办公自动化、电子商务的逐渐深入,政府部门、各单位和企业根据各自的业务需求建立了局域网并开发了各自的应用,而信息化的发展使得这些单域(在同一安全策略管理范围内的局域网)之间实现互连和信息共享的需求越来越迫切。在目前高度动态、异构化、分布式的现代信息系统中,跨越单个管理域的限制,在多个域之间进行安全互操作是一项非常必要的系统需求。然而,原有自主可控的单域网络在与其他网络互连后,如何实现安全可控的开放并保持原有应用的安全,即防止未授权用户访问和使用受保护的资源或服务,实现跨域授权管理,便成为了我们在信息化实施过程中要解决的关键问题之一。
本文综合分析了现有的基于授权管理基础设施PMI、属性证书和RBAC的访问控制模型,在公钥基础设施PKI和PMI的基础之上,提出了一种基于角色和属性证书的跨域授权管理系统模型,该模型充分考虑了多域环境下安全策略的制定以及域间的协作,符合分布式系统的实际情况,相比其他分布式授权管理系统模型,具有更强的实用性和安全性。论文详细描述了域内授权管理及域间的角色映射和授权步骤,并从物理结构和逻辑结构两个方面对系统的实现做了详细设计,最后在设定的一个原型环境下对理论模型进行了模拟实现和验证。整个模拟系统的实现具有灵活性、易维护性和可操作性。
As the popularization of OA and electronic business, departments in government and corporations have built local area network to develop their own applications according to their business needs. Information technology applications make the demand of interconnection and information-sharing among single-domains (the LANs under the control of a security policy) more and more pressing. Nowadays, dynamic, heterogeneous and distributed information systems call for secure interoperability between multi-domains beyond a single domain management restriction. However, after the independent and self-controlled single-domain network is interconnected with other networks, it's hard to maintain the security of the original applications whilst keep them controllable (i.e. prevent unauthorized users from accessing and using protected resources and services). In other words, realization of cross-domain authorization management has become one of the key issues to be solved to apply IT.
This thesis analyzes existing access control models which are based on PMI Attribute Certificate and RBAC, and then puts forward a distributed cross-domain privilege management model, which is called CD-RBAC. It uses roles and ACs for authorization and the realization of model is based on PKI (Public Key Infrastructure) and PMI (Privilege Management Infrastructure). In this model, constitution of the security policies and inter-domain collaboration in multi-domain environment has been considered. CD-RBAC model is in line with the actual situation in distributed systems, and is more practical and secure than other models. This thesis detailedly describes how to realize authorization management in domain, method of inter-domain role mapping, and authorization steps. Furthermore, the thesis makes a detailed instruction of the realization of the system in two aspects: the physical and logical structure. At last, we simulate and verify the theoretic model in a prototype environment. During the realization of this system, flexibility, maintenance and operability are fully considered.
本文综合分析了现有的基于授权管理基础设施PMI、属性证书和RBAC的访问控制模型,在公钥基础设施PKI和PMI的基础之上,提出了一种基于角色和属性证书的跨域授权管理系统模型,该模型充分考虑了多域环境下安全策略的制定以及域间的协作,符合分布式系统的实际情况,相比其他分布式授权管理系统模型,具有更强的实用性和安全性。论文详细描述了域内授权管理及域间的角色映射和授权步骤,并从物理结构和逻辑结构两个方面对系统的实现做了详细设计,最后在设定的一个原型环境下对理论模型进行了模拟实现和验证。整个模拟系统的实现具有灵活性、易维护性和可操作性。
As the popularization of OA and electronic business, departments in government and corporations have built local area network to develop their own applications according to their business needs. Information technology applications make the demand of interconnection and information-sharing among single-domains (the LANs under the control of a security policy) more and more pressing. Nowadays, dynamic, heterogeneous and distributed information systems call for secure interoperability between multi-domains beyond a single domain management restriction. However, after the independent and self-controlled single-domain network is interconnected with other networks, it's hard to maintain the security of the original applications whilst keep them controllable (i.e. prevent unauthorized users from accessing and using protected resources and services). In other words, realization of cross-domain authorization management has become one of the key issues to be solved to apply IT.
This thesis analyzes existing access control models which are based on PMI Attribute Certificate and RBAC, and then puts forward a distributed cross-domain privilege management model, which is called CD-RBAC. It uses roles and ACs for authorization and the realization of model is based on PKI (Public Key Infrastructure) and PMI (Privilege Management Infrastructure). In this model, constitution of the security policies and inter-domain collaboration in multi-domain environment has been considered. CD-RBAC model is in line with the actual situation in distributed systems, and is more practical and secure than other models. This thesis detailedly describes how to realize authorization management in domain, method of inter-domain role mapping, and authorization steps. Furthermore, the thesis makes a detailed instruction of the realization of the system in two aspects: the physical and logical structure. At last, we simulate and verify the theoretic model in a prototype environment. During the realization of this system, flexibility, maintenance and operability are fully considered.
引文
[1].刘宏月,范九伦,马建峰。访问控制技术研究发展。小型微型计算机系统,2004,25(1):56-59
[2].R.S.Sandhu,E.J.Coyne,H.L.Feinstein,et al.Role-Based Access Control Models.Computer,Feb 1996,29(2):38-47
[3].Eduward Coyne,Srinivas Ganta,Charles Youman.The ARBAC97 Model for Role-Based Administration of Roles:Preliminary Description and Outline.Proceedings of Second ACM Workshop on Role-Based Access Control,Faifax,Virginia,1997,1034-1045
[4].David F.Ferraiolo,R.S.Sandhu,Serban avrila,et al.Proposed NIST Standard for Role-Based Access Control.ACM Transactions on Information and Systems Security(TISSEC),Volume 4,Number 3,August 2001
[5].董光宇,卿斯汉,刘克龙.带时间特性的角色授权约束.软件学报,2002,13(8):1521-1527
[6].C Ellison,B Frantz,B Lampson,et al.SPKI Certificate Theory.RFC2693,IETF SPKI Working Group,1999
[7].段素娟,洪帆,骆婷。多域应用安全互操作的授权模型。华中科技大学学报,2003,11
[8].洪帆,黎成兵。多域结盟环境下基于角色的访问控制。计算机工程与科学,2004,11
[9].Apu Kapadia,Jalal Al-Muhtadi,R.Campbell,et al.IRBAC2000:Secure Interoperability Using Dynamic Role Translation.University of Illinois,Technical Report.June 26~(th)-29~(th),2000
[10].Tel Aviv Campbell R,Liu Z,Mickunas D,et al.Seraphism:Dynamic interoperable security architecture for active networks.IEEE OPE-NARCH 2000,March 2000.
[11].Freudenthal E,et al.dRBAC:Distributed Role-based Access Control for Dynamic Coalition Environments[EB/OL].http://www.cs.nyu.edu/vijayk/papers/drbac-icdcs02.pdf.2002-06
[12].Al-Muhtadi J,Kapadia A,Campbell R H,et al.A-IRBAC 2000 Model:Administrative Interoperable Role-Based Access Control;[Technical Report].UIUC-DCS-R-2000-2163.http://choices.cs.uiuc.edu/～almuhtad/
[13].冯登国,李丹。我国PKI/PMI标准的制定与应用。信息技术与应用,2003(8):12-13
[14].D.W.Chadwick,A.Otenko.The PERMIS X.509 role based privilege management infrastructure,Future Generation Computer Systems,Volume 19,Issue 2,February 2003:277-289
[15].D.W.Chadwick,A.Otenko.RBAC Policies in XML for X.509 Based Privilege Management,SEC 2002,Egypt,May 2002
[16].Wei Zhou,Christoph Meinel.Implement role based access control with attribute certificates.In Proceedings of the 6~(th)International Conference on Advanced Communication Technology(ICACT2004),Volume 1,Feb.2004,536-541
[17].安晓江,李大兴。PMI系统中RBAC策略的实现与管理。计算机工程与应用,2004(7):115-117
[18].郑洲,蒋兴浩等。LDAP目录服务在PKI/PMI中的应用。计算机工程,2004,30(18):49-51
[19].Dongqing Xie,Yongjing Wang,Huayong Chen.A new role-based access control model using attribute certificate.Intelligent Control and Automation(WCICA 2004),Fifth World Congress,Volume:5,June2004,15-19
[20].王雅哲,李大兴。基于PMI中间件的资源访问控制方案。计算机工程,2005,31(10):21-24
[21].朱贤,邢光林,洪帆。分布式环境下的访问控制综述。微型机与应用,2005(1):4-7
[22].卜宏,郭晓芳,赵静凯。分布式环境下的访问控制。计算机应用研究,2004(8):89-91
[23].Ravi Sandhu,David Ferraiolo,Richard Kuhn.The NIST Model for Role-Based Access Control Towards A Unified Standard.In proceedings of the 2000'ACM Workshop on Role-Based Access Control.ACM,2000
[24].Ravi Sandhu.Role-based access control[J].Advances in Computers,1998,46.237-286
[25].Gail-Joon Ahn,Dongwang Shin,Sangrate Cho.Role Based Access Control on Privilege Managerment Infrastructure.Final report;Collaborative research between UNC Charlotte and ETRI during the period of May 14~(th),2001-May 13~(th),20.
[26].David F.Ferraiolo,Ravi Sandhu,Serban Gavrila,D.Richard Kuhn.Proposed NIST Standard for Role-Based AccessControl[J].ACM Transactions on Information andSystem Security,2001,(3).224-274.
[27].R Sandhu,E Coyne,H Feinstein.a Role-based access control model[J].IEEE Computer,1995,29(1).38-47.
[28].李涛著。网络安全概论[M].第一版。北京:电子工业出版社,2004.11.91-120
[29].张红旗,李景峰。基于属性证书的X.509证书改进方案。计算机工程与应用,2001,20:72-74
[2].R.S.Sandhu,E.J.Coyne,H.L.Feinstein,et al.Role-Based Access Control Models.Computer,Feb 1996,29(2):38-47
[3].Eduward Coyne,Srinivas Ganta,Charles Youman.The ARBAC97 Model for Role-Based Administration of Roles:Preliminary Description and Outline.Proceedings of Second ACM Workshop on Role-Based Access Control,Faifax,Virginia,1997,1034-1045
[4].David F.Ferraiolo,R.S.Sandhu,Serban avrila,et al.Proposed NIST Standard for Role-Based Access Control.ACM Transactions on Information and Systems Security(TISSEC),Volume 4,Number 3,August 2001
[5].董光宇,卿斯汉,刘克龙.带时间特性的角色授权约束.软件学报,2002,13(8):1521-1527
[6].C Ellison,B Frantz,B Lampson,et al.SPKI Certificate Theory.RFC2693,IETF SPKI Working Group,1999
[7].段素娟,洪帆,骆婷。多域应用安全互操作的授权模型。华中科技大学学报,2003,11
[8].洪帆,黎成兵。多域结盟环境下基于角色的访问控制。计算机工程与科学,2004,11
[9].Apu Kapadia,Jalal Al-Muhtadi,R.Campbell,et al.IRBAC2000:Secure Interoperability Using Dynamic Role Translation.University of Illinois,Technical Report.June 26~(th)-29~(th),2000
[10].Tel Aviv Campbell R,Liu Z,Mickunas D,et al.Seraphism:Dynamic interoperable security architecture for active networks.IEEE OPE-NARCH 2000,March 2000.
[11].Freudenthal E,et al.dRBAC:Distributed Role-based Access Control for Dynamic Coalition Environments[EB/OL].http://www.cs.nyu.edu/vijayk/papers/drbac-icdcs02.pdf.2002-06
[12].Al-Muhtadi J,Kapadia A,Campbell R H,et al.A-IRBAC 2000 Model:Administrative Interoperable Role-Based Access Control;[Technical Report].UIUC-DCS-R-2000-2163.http://choices.cs.uiuc.edu/～almuhtad/
[13].冯登国,李丹。我国PKI/PMI标准的制定与应用。信息技术与应用,2003(8):12-13
[14].D.W.Chadwick,A.Otenko.The PERMIS X.509 role based privilege management infrastructure,Future Generation Computer Systems,Volume 19,Issue 2,February 2003:277-289
[15].D.W.Chadwick,A.Otenko.RBAC Policies in XML for X.509 Based Privilege Management,SEC 2002,Egypt,May 2002
[16].Wei Zhou,Christoph Meinel.Implement role based access control with attribute certificates.In Proceedings of the 6~(th)International Conference on Advanced Communication Technology(ICACT2004),Volume 1,Feb.2004,536-541
[17].安晓江,李大兴。PMI系统中RBAC策略的实现与管理。计算机工程与应用,2004(7):115-117
[18].郑洲,蒋兴浩等。LDAP目录服务在PKI/PMI中的应用。计算机工程,2004,30(18):49-51
[19].Dongqing Xie,Yongjing Wang,Huayong Chen.A new role-based access control model using attribute certificate.Intelligent Control and Automation(WCICA 2004),Fifth World Congress,Volume:5,June2004,15-19
[20].王雅哲,李大兴。基于PMI中间件的资源访问控制方案。计算机工程,2005,31(10):21-24
[21].朱贤,邢光林,洪帆。分布式环境下的访问控制综述。微型机与应用,2005(1):4-7
[22].卜宏,郭晓芳,赵静凯。分布式环境下的访问控制。计算机应用研究,2004(8):89-91
[23].Ravi Sandhu,David Ferraiolo,Richard Kuhn.The NIST Model for Role-Based Access Control Towards A Unified Standard.In proceedings of the 2000'ACM Workshop on Role-Based Access Control.ACM,2000
[24].Ravi Sandhu.Role-based access control[J].Advances in Computers,1998,46.237-286
[25].Gail-Joon Ahn,Dongwang Shin,Sangrate Cho.Role Based Access Control on Privilege Managerment Infrastructure.Final report;Collaborative research between UNC Charlotte and ETRI during the period of May 14~(th),2001-May 13~(th),20.
[26].David F.Ferraiolo,Ravi Sandhu,Serban Gavrila,D.Richard Kuhn.Proposed NIST Standard for Role-Based AccessControl[J].ACM Transactions on Information andSystem Security,2001,(3).224-274.
[27].R Sandhu,E Coyne,H Feinstein.a Role-based access control model[J].IEEE Computer,1995,29(1).38-47.
[28].李涛著。网络安全概论[M].第一版。北京:电子工业出版社,2004.11.91-120
[29].张红旗,李景峰。基于属性证书的X.509证书改进方案。计算机工程与应用,2001,20:72-74