一种高阶权限指派约束的安全性与一致性验证

计算机工程

一种高阶权限指派约束的安全性与一致性验证

王正,许德武,韩建民,鲁剑锋

(浙江师范大学数理与信息工程学院,浙江金华 321004)

收稿日期:2016-12-22 出版日期:2018-01-15 发布日期:2018-01-15
作者简介:王正(1986—),男,硕士研究生,主研方向为访问控制技术、算法优化;许德武,副教授、硕士;韩建民,教授、博士;鲁剑锋(通信作者),副教授、博士。
基金资助:
国家自然科学基金(61402418,61672468);教育部人文社科研究项目(12YJCZH142);浙江省公益技术研究社会发展项目(2017C33054);浙江省自然科学基金(LY13F020017,LY15F020013)。

Safety and Consistency Verification for a High-level Permission Assignment Constraint

WANG Zheng,XU Dewu,HAN Jianmin,LU Jianfeng

(School of Mathematics,Physics and Information Engineering,Zhejiang Normal University,Jinhua,Zhejiang 321004,China)

Received:2016-12-22 Online:2018-01-15 Published:2018-01-15

摘要/Abstract

摘要： 现有权限指派约束往往侧重于保障系统的安全性而忽略了可用性。为此,提出一种兼顾安全性与可用性需求的高阶权限指派约束。定义高阶权限指派约束的安全性验证和一致性验证问题,分别为验证一个访问控制状态是否能够满足一个高阶权限指派约束,以及判断是否存在某个访问控制状态能够满足多个高阶权限指派约束,并证明其在一般情形下分别是NP-complete和NPNP问题。结合预处理及规约为可满足性问题的求解器,设计针对一致性验证问题的优化求解算法。仿真实验结果验证了该算法的有效性。

关键词: 访问控制, 安全性, 可用性, 权限指派, SAT求解器, 计算复杂度

Abstract: Existing permission assignment constraints pay more attention to ensure the safety,however the availability for the system is ignored.Aiming at this problem,this paper proposes a High-level Permission Assignment (HPA)constraint to satisfy the safety and availability requirements simultaneously.It defines the safety verification problem and consistency verification problem,which determine whether an access control state can satisfy a HPA constraint,and whether there exists a valid access control state to satisfy a set of high-level permission assignment constraints.The computing complexities of the safety verification problem and the consistency verification problem show that computing complexities of these two problems are NP-complete and NPNP.It also designs an optimized algorithm for the consistency checking problem by incorporating preprocessing and reducing to Satisfiability(SAT) problem solver.Simulation experimental results verify the effectiveness of the proposed algorithm.

Key words: access control, safety, availability, permission assignment, Satisfiability(SAT) solver, computing complexity

中图分类号:

TP309

王正,许德武,韩建民,鲁剑锋. 一种高阶权限指派约束的安全性与一致性验证[J]. 计算机工程.

WANG Zheng,XU Dewu,HAN Jianmin,LU Jianfeng. Safety and Consistency Verification for a High-level Permission Assignment Constraint[J]. Computer Engineering.

参考文献

参考文献［1］李瑞轩,鲁剑锋,李添翼,等.一种访问控制策略非一致性冲突消解方法［J］.计算机学报,2013,36(6):1210-1223. ［2］WANG X,SHI W,XIANG Y,et al.Efficient Network Security Policy Enforcement with Policy Space Analysis［J］.IEEE/ACM Transactions on Networking,2016,24(5):2926-2938. ［3］LU J,LI R,LU Z,et al.Specification and Enforcement of Static Separation-of-Duty Policies in Usage Control［C］//Proceedings of the 12th Information Security Conference.Pisa,Italy:［s.n.］,2009:403-410. ［4］LI N,WANG Q.Beyond Separation of Duty:An Algebra for Specifying High-level Security Policies［J］.Journal of the ACM,2008,55(3):1-30. (下转第181页) (上接第175页) ［5］LU J,LI R,HU J,et al.Inconsistency Resolving of Safety and Utility in Access Control［J］.EURASIP Journal on Wireless Communications and Networking,2011(1):1-12. ［6］LI R,LU J,LU Z,et al.Consistency Checking of Safety and Availability in Access Control［J］.IEICE Transactions on Information and Systems Society,2010,E93-D(3):491-502. ［7］MAO B,WU S,JIANG H.Exploiting Workload Characteristics and Service Diversity to Improve the Availability of Cloud Storage Systems［J］.IEEE Transactions on Parallel and Distributed Systems,2016,27(7):2010-2021. ［8］RAWAT A S,PAPAILIOPOULOS D S,DIMAKIS A G,et al.Locality and Availability in Distributed Storage［J］.IEEE Transactions on Information Theory,2016,62(8):4481-4493. ［9］LI N,WANG Q,TRIPUNITARA M V.Resiliency Policies in Access Control［J］.ACM Transactions on Information and System Security,2009,12(4):1-34. ［10］SHEN L,WANG Z,ZHANG X,et al.Study on the Policy Conflict Detection in the Security Management Model［C］//Proceedings of IEEE International Conference on Signal Processing Communications and Computing.Washington D.C.,USA:IEEE Press,2015:1-5. ［11］ELKANDOUSSI A,ELBAKKALI H,ELHILALI N.Toward Resolving Access Control Policy Conflict in Inter-organizational Workflows［C］//Proceedings of the 12th IEEE/ACS International Conference of Computer Systems and Applications.Washington D.C.,USA:IEEE Press,2015:1-4. ［12］吴迎红,黄皓,吕庆伟,等.基于开放逻辑R反驳计算的访问控制策略精化［J］.软件学报,2015,26(6):1534-1556. ［13］LUPU E,SLOMNA M.Conflicts in Policy-based Distributed Systems Management［J］.IEEE Transactions on Software Engineering(Special Issue on Inconsisteney Management),1999,25(6):852-869. ［14］姚键,茅兵,谢立.一种基于有向图模型的安全策略冲突检测方法［J］.计算机研究与发展,2005,42(7):1108-1114. ［15］CHOLVY L,CUPPENS F.Analyzing Consistency of Security Policies［C］//Proceedings of IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,1997:103-112. ［16］PAPADIMITRIOU C H.Computational Complexity［M］.［S.l.］:Addison Wesley Longman,1994. 编辑金胡考

[1]	黄保华, 郑慧颖, 屈锡, 陈宁江. 联盟链高效存储访问控制方案[J]. 计算机工程, 2023, 49(8): 37-45.
[2]	田秀霞, 杨明夷. 家庭物联网中基于智能合约的访问控制机制[J]. 计算机工程, 2023, 49(3): 18-28.
[3]	汪小勇, 董德存, 欧冬秀. 车载TBTC-CBTC系统降级场景下的CPN建模与仿真[J]. 计算机工程, 2022, 48(7): 189-198.
[4]	丁晓晖, 曹素珍, 王彩芬. 智能合约辅助下满足前后向安全的动态可搜索加密方案[J]. 计算机工程, 2022, 48(7): 141-150.
[5]	张超, 彭长根, 丁红发, 许德权. 基于国密SM9的可搜索加密方案[J]. 计算机工程, 2022, 48(7): 159-167.
[6]	谷青竹, 董红斌. PPDM中面向k-匿名的MI Loss评估模型[J]. 计算机工程, 2022, 48(4): 143-147.
[7]	刘晶, 朱炳旭, 梁佳杭, 任女尔, 季海鹏. 基于主侧链合作的区块链访问控制策略[J]. 计算机工程, 2022, 48(3): 10-16,22.
[8]	王静宇, 周雪娟. 一种支持属性撤销的密文策略属性基加密方案[J]. 计算机工程, 2021, 47(7): 95-100.
[9]	张本宏, 吴浩浩, 俞磊. 车载自组织网络中基于竞争的时分多址MAC协议[J]. 计算机工程, 2021, 47(5): 154-159.
[10]	李秋贤, 周全兴, 王振龙, 丁红发, 潘齐欣. 基于隐私保护的可证明安全委托计算协议[J]. 计算机工程, 2021, 47(5): 131-137.
[11]	张建国, 胡晓辉. 基于以太坊的改进物联网设备访问控制机制研究[J]. 计算机工程, 2021, 47(4): 32-39,47.
[12]	张江徽, 崔波, 李茹, 史锦山. 基于智能合约的物联网访问控制系统[J]. 计算机工程, 2021, 47(4): 21-31.
[13]	高子轩, 郑烇. NDMANET中基于内容优先级的缓存策略研究[J]. 计算机工程, 2021, 47(3): 190-195.
[14]	蔡爵嵩, 严迎建, 朱春生. 结合协方差与变异系数的密码芯片能量泄漏评估模型[J]. 计算机工程, 2021, 47(3): 37-42,52.
[15]	詹长健, 雷磊, 沈高青, 李志林. 适用于水声传感网络的多链路传输MAC协议[J]. 计算机工程, 2021, 47(2): 194-200.

选择文件类型/文献管理软件名称

选择包含的内容