摘要： 在分布式计算环境下，传统基于属性的静态访问控制策略多存在扩展性差、难以实现等问题。针对上述问题，提出一种基于策略属性分解的冲突检测算法。该算法对策略属性进行分解，构造策略属性分解图，判断策略属性值之间的相交关系，根据静态策略冲突的定义进行策略冲突检测，从而提高策略冲突检测算法的可扩展性和易实现性。实验结果表明，该算法对静态策略冲突的检测率接近85%。

关键词: 基于属性的访问控制模型, 策略管理, 静态策略, 策略冲突, 策略属性分解, 冲突检测

Abstract: This paper discusses static access control policy conflict detection of Attribute Based Access Control(ABAC) in the distributed computing environment, proposes a static policy conflict detection algorithm based on policy attributes decomposition. Policy attributes are decomposed and the graph of policy attributes decomposition is constructed. The intersection relationship between predicates of policy attribute is judged. The algorithm detects policy conflicts by the definition of static policy conflict which improves extensibility and achievability. Experimental result indicates that the policy conflict detection rate of proposed algorithm can reach 85%.

Key words: Attribute Based Access Control(ABAC) model, policy management, static policy, policy conflict, policy attributes decomposition, conflict detection

中图分类号: 

• TP309.2