摘要： 提出了一个授权与访问控制系统的设计,它以PMI为基本架构,分为授权服务和访问控制两个子系统,权限管理子系统通过各种模 块制定全局所衙的各种策略,由AA／SOA签发各种策略属性证书;管理员通过注册服务器ARA,为用户分配权限,向AA申请签发用户的属性 证书。在访问控制子系统中,策略决策实施点(AEF)截获用户的访问请求及用户身份并发送给访问控制决策点中的ADF,ADF根据权限管 理子系统制定好的策略和用户的属性证书计算出用户被授予的访问权限,作出"允许,拒绝"的决策。这样就实现了对Web资源的授权与访问 控制。保证了后端Web服务器上共享数据的安全。

关键词: 授权管理基础设施, 基于角色的访问控制模型, 属性证书, 策略

Abstract: This paper offers a system about authorization and access control. This system contains privilege management subsystem and access control subsystem. Privilege management subsystem makes all kinds of polices for the whole situation by diversified modules. In this subsystem, attribute authority (AA) or souse of authority (SOA) signed all kinds of policy attribute certificate, and administrators allocate privilege to users by attribute registration authority (ARA) and apply for users attribute certificate from AA. In the access control subsystem, the access control enforcement function (AEF) achieves users access requests and users identities and sends the information to the access control decision function (ADF). ADF calculates the users granted privilege and makes the permit or refuse decision based on the policy and the users attribute certificate made by the privilege management subsystem. Consequently, the system realizes the authorization and access control and ensures the security of the shared data in the back Web servers.

中图分类号: 

• TP393.08