基于属性的扩展委托模型

为提高委托过程的安全性，对现有委托模型进行了扩展，提出了一个更加安全的基于属性的扩展委托模型（ABDMA）．ABDMA中的委托约束不但包括委托先决条件（CR），还包含委托属性表达式（DAE）．受托者必须同时满足委托先决条件和委托属性表达式才能被委托权限或角色．为保证委托过程的灵活性，ABDMA将委托属性表达式进一步分为永久和临时委托属性表达式，使得委托者可临时而不是永久地将某些高级权限委托给不具备资格的用户．ABDMA提高了委托过程的安全性，减轻了委托者和系统管理员的负担．

An Attribute-Based Extended Delegation Model

To increase the security of delegation, an attribute-based delegation model called ABDM_A is presented, which is an extension of current delegation models. Delegation constraint in ABDM_A consists of both delegation attribute expression (DAE) and delegation prerequisite condition (CR). Delegatees must satisfy delegation constraint (especially DAE) when assigned to a delegation role. For a better flexibility, delegation attribute expression is divided into two types: permanent and temporary delegation attribute expressions. With temporary delegation attribute expression, the delegator can temporarily, not permanently, delegate high level permission to low level delegatees. ABDM_A relieves the security management effort of the delegator and the system administrator in delegation and increases the security of delegation.