基于属性约束的权限委托机制及冲突检测方法

针对现有的委托方法中委托约束局限于用户角色的问题，提出了一种基于属性约束的权限委托机制ARPDM，使用先决条件、受托条件和撤销条件等对委托者和受托者的能力进行约束，能够增加权限委托的约束能力，从多个方面对委托者和受托者的委托行为进行控制。分析了委托过程中可能发生的委托约束冲突、冗余委托冲突和环状委托冲突等，设计了一种基于委托树的冲突检测算法，将冲突问题映射为树中结点的关系问题，能够通过一次遍历检测多种冲突，避免了传统方法需要多次检测的问题，具有较高的效率。

Attribute restricted permission delegation mechanism and delegation conflict detecting method

To solve the constraints of user role in permission delegation methods, the paper proposes an attribute restricted permission delegation mechanism to strengthen the delegation constraints, in which the capability of delegators and delegatees is constrained by prerequisite condition, delegatee condition and revoke condition. By analyzing conflicts existing in the process of delegation, such as delegation constraint conflicts, redundant delegation conflicts, circle delegation conflicts and so on, this paper designs a conflict detection algorithm based on delegation tree. In this algorithm, permission conflicts can be expressed the relationship of nodes in delegation tree, and multiple delegation conflicts can be detected efficiently through one traversing of delegation tree.