电子政务基于属性证书的访问控制模型

随着我国电子政务的发展,如何保障电子政务中的资源信息不被非法访问已成为当务之急。如何进行用户对资源和服务使用的限制,决定主体是否对客体有权限进行某种操作,即对用户进行访问控制的问题信息安全研究中的重要方面。授权来源于访问控制,即先对用户进行授权,然后根据用户具有的权限来进行访问控制。属性证书包含了一系列用户的权限信息,所以属性证书可以看作是权限信息的载体。根据属性证书中用户的权限信息可以对用户访问资源进行控制,基干角色的访问控制(RBAC)是一种新兴的访问控制技术和理念,是将用户划分成与其职能和职位相符合的角色,根据角色赋予相应操作权限,以减少授权管理的复杂性,降低管理开销和为管理员提供一个比较好的实现复杂安全政策的环境,是传统的自主访问控制和强制访问控制的升级和替代。RBAC的建模和实现技术是目前RBAC技术研究的热点和难点。NRBAC模型是一种更接近现实情况的模型。基于属性证书和电子政务中存在的特殊要求和特点,结合RBAC96、ARBAC97模型以及NRBAC模型,构造了一个适合电子政务系统使用的基于角色的安全访问控制模型eGA-NRBAC;利用该访问控制模型解决了电子政务工程中授权管理系统和授权服务系统的工程化实现问题。测试和实际使用都证明了此访问控制模型的正确性、可行性和可靠性。     

面向Web服务工作流系统的访问控制模型

提出了一种面向Web服务工作流系统的访问控制模型（WSWF-RBAC）。在基于角色的访问控制模型基础上引入系统资源的概念,把Web服务对象、属性和其它功能模块当做资源统一管理。引XT资源访问模式的概念,在约束条件下通过与资源的运算生成系统权限,从而实现了对权限的精细管理和动态调整能力。通过扩展web服务访问的角色集和用户集,并引入角色扮演对象,实现了工作流系统中Web服务与其它模块访问控制的一致性。将该模型应用于库房供应链系统中,运行结果表明,该模型能够增强Web服务工作流系统授权的灵活性和安全性。     

基于PMI中间件的资源访问控制方案

授权管理基础设施(PMI)的核心思想是在PKI的基础上,实现权限管理和访问控制的有机结合,建立一个与具体应用系统相对分离的权限管理和授权服务系统。该文应用服务器插件技术和安全性断言标记语言(SAML)开发PMI中间件,在多种类型Web服务器上实现基于角色的资源访问控制。     

Web服务中身份认证与访问控制模型的研究

Web服务分布式、异构的本质。使得对服务请求者进行身份认证和授权变得复杂,针对这些问题提出了一个基于SAML,XACML,RBAC等关键技术的身份认证与访问控制模型。该模型采用SAML辅件技术实现Web服务的单点登录;用XACML实现RBAC模型,简化授权管理,同时达到对资源的细粒度访问控制的目标;用扩展的SAML语法支持XACML信息的安全有效传输。     

基于角色的细粒度访问控制模型的设计与实现

为有效解决目前权限管理中存在的授权复杂、不灵活等问题,提出了基于角色的细粒度访问控制模型.改进基于角色的访问控制模型,在其中引入属性约束和用户组,从访问控制的粒度出发分析并设计出基于角色的细粒度模型.新模型有效减少了角色和权限的授予数量,降低了权限管理复杂性,确保了细粒度的访问控制.通过将新模型具体运用到基于J2EE的Web系统并以用户权限树和存储过程实现,表明了新模型的可行性、灵活性和高效性.     

基于PMI的Web Service访问控制方案

随着Web Service的广泛应用,访问控制在其中的作用越来越得到体现.PMI作为权限管理设施为Web Service提供了统一的授权管理方法,实现对服务资源的有效保护.介绍了Web Service和PMI访问控制模型的基本功能和框架,详细论述了一种基于PMI的Web Service访问控制系统的设计方案,并对其中的消息传输、策略描述以及具体过程作了进一步的分析.     

基于活动授权的组合Web服务业务流程动态访问控制模型研究

业务流程访问控制机制是组合Web服务安全应用中的难点问题。针对现有研究不足,提出基于活动授权的Web服务业务流程动态访问控制模型AACBP(Activity Authorization Based Dynamic Access Control Model for BPEL4WS)。通过解除组织模型和业务流程模型间的耦合关系,AACBP将活动授权作为BPEL4WS(Business Process Expression Language for Web Services)活动访问控制实施的基本单元。依据活动实例动态感知上下文,AACBP细粒度约束活动访问授权,实现授权流与业务流程执行同步。最后给出AACBP模型在Web服务安全组合中的实施机制。     

面向特征的Web服务角色访问控制

本文在基于角色的Web服务访问控制模型基础上,提出了一个面向特征的Web服务角色访问控制模型.该模型引入特征作为基本的访问控制单元,它可以同时从任务角度和从系统角度来保护资源,解决了以前无法同时兼顾信息的机密性和数据的完整性的问题,从而加强访问控制的控制力度和安全性.     

基于用户-角色-任务的多约束访问控制模型

传统的访问控制模型采用手动的授权方式, 应用在目前混合型组织企业中, 造成权限授权复杂、准确度低. 因此, 提出一种基于用户-角色-任务的多约束访问控制模型(C-URTBAC), 该模型采用用户分级管理、权限在主体和客体间的传播性思想, 实现了半自动化的授权方式, 提高授权效率和准确度; 同时细化了约束分类, 实现了细粒度化的权限管理. 最后将该模型引用到某汽车零部件公司的PLM系统中, 验证了该模型的实用性.     

基于RBAC的权限管理在Web中的设计与实现

访问控制技术在Web信息系统中已得到了大量应用。相对于传统的自主访问控制模型和强制访问控制模型,基于角色的访问控制（RBAC）具有降低授权管理复杂性、减少管理开销以及能提供与企业组织结构相一致的安全策略等优势。文章使用J2EE的框架Struts2设计并实现了基于RBAC的权限管理。     

煤矿井下安全监控分站的设计及其仿真实现

为了设计一种具有低成本、低功耗、易操作、功能强且可靠性高的煤矿井下安全分站,针对煤矿安全生产实际,文章提出了采用MCS-51系列单片机为核心、具有CAN总线通信接口的煤矿井下安全监控分站的设计方案;首先给出煤矿井下安全监控分站的整体构架设计,然后着重阐述模拟量输入信号处理系统的设计过程,最后说明单片机最小系统及其键盘、显示、报警、通信等各个组成部分的设计;为验证设计方案的可行性与有效性,使用Proteus软件对设计内容进行仿真验证,设计的煤矿井下安全监控分站具有瓦斯、温度等模拟量参数超标报警功能和电机开停、风门开闭等开关量指示功能;仿真结果表明:设计的煤矿井下安全监控分站具有一定的实际应用价值.     

Call for Papers The 6^th International Conference on Grid and Cooperative Computing

Recent years have seen rapid advances in various grid-related technologies, middleware, and applications. The GCC conference has become one of the largest scientific events worldwide in grid and cooperative computing. The 6th international conference on grid and cooperative computing (GCC2007) Sponsored by China Computer Federation (CCF),Institute of Computing Technology, Chinese Academy of Sciences (ICT) and Xinjiang University ,and in Cooperation with IEEE Computer Soceity ,is to be held from August 16 to 18, 2007 in Urumchi, Xinjiang, China.     

View-based model-driven architecture for enhancing maintainability of data access services

In modern service-oriented architectures, database access is done by a special type of services, the so-called data access services (DAS). Though, particularly in data-intensive applications, using and developing DAS are very common today, the link between the DAS and their implementation, e.g. a layer of data access objects (DAOs) encapsulating the database queries, still is not sufficiently elaborated, yet. As a result, as the number of DAS grows, finding the desired DAS for reuse and/or associated documentation can become an impossible task. In this paper we focus on bridging this gap between the DAS and their implementation by presenting a view-based, model-driven data access architecture (VMDA) managing models of the DAS, DAOs and database queries in a queryable manner. Our models support tailored views of different stakeholders and are scalable with all types of DAS implementations. In this paper we show that our view-based and model driven architecture approach can enhance software development productivity and maintainability by improving DAS documentation. Moreover, our VMDA opens a wide range of applications such as evaluating DAS usage for DAS performance optimization. Furthermore, we provide tool support and illustrate the applicability of our VMDA in a large-scale case study. Finally, we quantitatively prove that our approach performs with acceptable response times.     

A pragmatic multi-method investigation of discrepant technological events: Coping,attributions, and ‘accidental’ learning

Discrepant technological events or situations that entail a problem, a misunderstanding or a difficulty with the Information Technology (IT) being employed, are common in the workplace, and can lead to frustration and avoidance behaviors. Little is known, however, about how individuals cope with these events. This paper examines these events by using a multi-method pragmatic approach informed by coping theory. The results of two studies – a critical incident study and an experiment – serve to build and test, respectively, a theoretical model that posits that individuals use a variety of strategies when dealing with these events: they experience negative emotions, make external attributions, and adopt engagement coping strategies directed at solving the event, eventually switching to a disengagement coping strategy when they feel they have no control over the situation. Furthermore, users’ efforts may result in ‘accidental’ learning as they try to overcome the discrepant IT events through engagement coping. The paper ends with a discussion of the results in light of existing literature, future opportunities for research, and implications for practice.     

The Distributed Time-Triggered Simulation Scheme: Core Principles and Supporting Execution Engine

Distributed real-time simulation is a young technology field but its practice is under increasing demands. In recent years the author and his collaborators have been establishing a new approach called the distributed time-triggered simulation (DTS) scheme which is conceptually simple and easy to use but widely applicable. The concept was initiated in the course of developing a new-generation object-oriented real-time programming scheme called the time-triggered message-triggered object (TMO) programming scheme. Some fundamental issues inherent in distributed real-time simulation that were learned during recent experimental studies are discussed along with some approaches for resolving the issues. An execution engine developed to support both the TMOs engaged in control computation and the TMOs engaged in DTS is also discussed along with its possible extensions that will enable significantly larger-scale DTSs.     

Software-Konfigurationsmanagement in großen Softwareprojekten

Zusammenfassung Mit zunehmender Größe der Softwaresysteme verschärfen sich die für die Software-Herstellung typischen Probleme: Beherrschen großer Objektmengen, Erhalten der Systemkonsistenz, Kontrolle der ständigen Änderungseinflüsse und Gewährleisten einer langen Lebensdauer. Die Disziplin Konfigurationsmanagement bildet den methodischen Ansatz, diese Probleme besser zu beherrschen. Software-Konfigurationsmanagement faßt die Herstellung von Softwaresystemen als eine Abfolge von kontrollierten Änderungen an gesicherten Zwischen- und Endergebnissen auf. Dargestellt werden die Objekte und Funktionen des Software-Konfigurationsmanagements sowie die hierfür in großen Software-Projekten benötigten Methoden, Instanzen und Hilfsmittel.     

Information for Authors

正http://www.zju.edu.cn/jzus http://www.springerlink.com Aim The Journals of Zhejiang University-SCIENCE(A/B/C)are edited by the international board of distinguished Chinese and foreign scientists,and are aimed to present the latest developments and achievements in scientific research in China and     

Editorial:Brain-machine interface(BMI) and cyborg intelligence

正Brain-machine interfaces(BMIs)aim at building a direct communication pathway between the brain and an external device,and represent an area of research where significant progress has been made during the past decade.Based on BMIs,mind information can be read out by neural signals to control     

Information for Authors

正http://www.zju.edu.cn/jzus http://www.springerlink.com Aim The Journals of Zhejiang University-SCIENCE(A/B/C)are edited by the international board of distinguished Chinese and foreign scientists,and are aimed to present the latest developments and achievements in scientific research in China and overseas to the world’s scientific circles,especially to stimulate     

SCIENCE CHINA Information Sciences SUBJECT INDEX TO VOLUME 57(2014)

正~~