电子政务中跨域可信数据交换模型设计与实现

分析了构成电子政务应用平台支撑之一的数据交换平台功能受到制约的关键因素及现有的解决办法。建立并形式化了域标识和域关系模型,设计了基于域标识和域关系的可信数据交换模型框架,在模型的实现部分,提出了扩展单交换所必需的基础设施,以及模型实现中两个最关键的问题——全局解析机构和域标识解析的解决方法。     

IRBAC2000安全性研究

分布式环境下多域之间的访问控制是实现跨域授权必须要解决的问题之一。IRBAC2000通过角色映射灵活地实现域间安全互操作,但是该模型缺乏对关联的管理,会带来潜在的安全问题。本文给出了冲突关联的形式化定义,并提出了模型中是否存在冲突关联以及角色映射是否会违背静态互斥角色约束的判定算法,从而增强了模型的安全性,结合PMI相关知识可以解决分布式计算环境下的跨域授权问题。     

异构信息系统下安全策略协同的设计与形式化语言描述

在异构的信息系统中,为了保障信息的安全,都会采用相应强度的访问控制技术和策略。为了在异构信息系统之间,能够有效地共享资源,就需要在异构系统间实现安全策略的协同。给出了一个基于票据的安全策略协同模型,用形式化的语言对其进行了描述,并完成了对票据权限的计算     

基于多级安全策略的二维标识模型

安全模型是用形式化的方法来描述如何满足系统的安全要求．经典的安全模型都只能要么满足系统的保密性要求(如BLP模型)，要么满足完整性的要求(如Biba模型)．该文提出了一个多级安全策略的二维标识模型，在对可信主体必须遵守最小特权原则的前提下，利用保密性标识和可信度标识共同构成主客体的访问标识，并利用两个约束条件，使得既能防止越权泄露信息．又能控制信息的非授权修改，从而同时保证了系统的保密性和完整性．     

网络隔离系统中策略管理平台设计与实现

在分析了跨信任域环境下利用网络隔离系统实现数据可控交换过程中的安全需求的基础上,本文设计并实现安全策略管理平台为隔离系统提供整体安全策略。通过集中部署和协同响应,解决分布式异构网络安全网关配置管理,实现安全策略协同与综合管理,提高系统整体防御性。     

基于使用控制和上下文的动态网格访问控制模型研究

网格环境动态、多域和异构性的特点决定其需要灵活、易于扩展和精细的授权机制.近来在网格环境下的访问控制方面做了大量研究,现有的模型大多在相对静止的前提下,基于主体的标识、组和角色信息进行授权,缺乏具体的上下文信息和灵活的安全策略.本文提出了网络环境下基于使用控制和上下文的动态访问控制模型.在该模型中,授权组件使用主体和客体属性定义传统的静态授权;条件组件使用有关的动态上下文信息体现了对主体在具体环境中的动态权限控制.在该模型的基础上,本文实现了一个原型系统,以验证模型的效率和易于实现性.     

产业链协同SaaS平台多租户权限管理技术

面向汽车及零部件产业链协同SaaS平台的多核网状企业群协同管理需求,在传统的RBAC模型的基础之上,提出一种以龙头企业为核心的多租户多级授权模型,运用菜单动态生成技术、URL地址解析算法实现了权限的解析,有效地控制了用户的访问权限.经验证,提出的模型和实现方法有效解决了产业链协同SaaS平台上多租户的用户权限管理问题.     

基于TRBAC的协同设计动态访问控制

针对协同设计过程中由于任务执行的动态性承担任务的角色与权限之间的动态分配问题,在协同设计访问控制中引入任务关联,提出一种基于任务/角色的动态访问控制模型TRBAC,给出TRBAC的形式化描述。论述基于TRBAC的协同设计动态访问过程,设计其访问授权及控制算法。以凸轮组协同设计为例,通过引入TRBAC模型,实现其动态访问控制。     

应用区域边界授权模型

应用区域边界安全系统是一个关防系统,它在使用过程中能否达到保护应用环境安全的目标是由其安全授权规则集的完备性和一致性及对其授权的简便性决定的。应用环境中的主体是通过各种不同的应用协议对客体进行访问的,它们在通过应用区域边界安全系统时,应用区域边界安全系统将根据安全授权规则集对其访问请求进行检验,若满足安全授权规则集要求,则允许通过,反之拒绝。因此,我们根据访问请求所涉及的主体、客体、协议、安全策略等部件,给出了应用区域边界授权的体系结构,同时在给出刻画它们特性的谓词基础上,提出了易于表达安全策略的应用区域边界形式化授权模型。对此形式化模型进行编译不仅可以根据安全策略对授权的合法性进行检验,而且也可以及时发现安全策略中存在的漏洞,从而可以得到一个正确的安全授权规则集。     

Linux操作系统安全策略模拟的研究与设计

操作系统是计算机系统平台的核心和基础,从操作系统安全策略和安全模型的角度,分析了中国墙模型和Bell-Lapadula(BLP)模型之间的区别与联系.为使操作系统有效地支持多种安全策略,设计了用中国墙模型非形式化地模拟实现BLP模型的过程,为操作系统对灵活安全策略的支持提供了例证.     

一种分布式环境下基于角色的访问控制模型

针对访问控制模型在分布式系统下的局限性,提出一种分布式系统下的基于角色的访问控制模型。该模型以传统RBAC为基础,对其进行了扩展,一方面通过将角色扩展为职能角色和任务角色,另一方面为任务角色增加一个属性,用以标识该角色所赋予的主体属于本域还是外域,避免了采用对等角色直接进行角色分配的简单化处理。从而一方面有利于最小权限的实现,另一方面实现了对本域和外域的主体访问请求采用不同的策略,使基于角色的控制应用范围从集中式的控制领域扩展到分布式的控制领域,以适应不断发展的分布式环境系统的需求。     

授权与访问控制策略模型的研究

针对现有授权与访问控制系统大规模、跨地域、分布式、多应用的发展趋势,在分析系统中策略分类和策略管理的作用的基础上,从策略之间的约束关系和策略作用范围的角度出发,创建了适应分布式环境的策略层次、策略作用域模型。     

A formal role-based access control model for security policies in multi-domain mobile networks

Mobile users present challenges for security in multi-domain mobile networks. The actions of mobile users moving across security domains need to be specified and checked against domain and inter-domain policies. We propose a new formal security policy model for multi-domain mobile networks, called FPM-RBAC, Formal Policy Model for Mobility with Role Based Access Control. FPM-RBAC supports the specification of mobility and location constraints, role hierarchy mapping, inter-domain services, inter-domain access rights and separation of duty. Associated with FPM-RBAC, we also present a formal security policy constraint specification language for domain and inter-domain security policies. Formal policy constraint specifications are based on ambient logic and predicate logic. We also use ambient calculus to specify the current state of a mobile network and actions within security policies for evaluation of access requests according to security policies. A novel aspect of the proposed policy model is the support for formal and automated analysis of security policies related to mobility within multiple security domains.     

基于DTE策略的安全域隔离Z形式模型

基于DTE策略的安全域隔离技术是构造可信系统的基本技术之一.但现有DTE实现系统存在安全目标不明确、缺乏对系统及其安全性质的形式定义和分析的缺点,导致系统安全性难以得到保证.定义了一个基于DTE策略的安全域隔离模型,采用Z语言形式定义了系统状态、基于信息流分析的不变量和安全状态,并借助Z/EVES工具给出验证系统安全的形式分析方法.解决了DTE系统的形式化建模问题,为安全域隔离技术的实现和验证奠定了基础.     

分布式系统中计算安全问题的一种解决方案

分布式计算系统安全问题分为两大类：分布式计算的安全和主机的安全。其中恶意主机问题较难解决，该文通过对恶意主机问题的形式化分析，提出了一种基于可信域的终端模型(Trust Domain Based Terminal Model, TDBTM)。该模型通过分布式应用参与制定本地访问控制决策来解决分布式系统对信息的机密性和完整性要求。同时提出了基于该模型以及可信计算思想设计的体系结构(Trust Domain Based Terminal Architecture, TDBTA)，以满足远程证实终端系统可信的需要。结合上述两点内容，该方案有望从根本上解决分布式计算系统中恶意主机带来的安全问题。     

一种基于本体相似度的多域策略集成方法

对各成员域的访问控制策略进行语义提取,是避免多域策略集成时可能产生概念和逻辑关系冲突的有效途径。提出一种基于本体相似度的多域互操作策略集成方法SPIOS,通过对成员域访问控制策略本体进行语义级映射,融入基于Bayesian概率的机器学习机制,自适应地归纳出能较好满足各成员域自治性和协同性的多域安全互操作策略模型。     

Modeling conversation policies using permissions and obligations

Both conversation specifications and policies are required to facilitate effective agent communication. Specifications provide the order in which speech acts can occur in a meaningful conversation, whereas policies restrict the specifications that can be used in a certain conversation based on the sender, receiver, messages exchanged thus far, content, and other context. We propose that positive/negative permissions and obligations be used to model conversation specifications and policies. We also propose the use of ontologies to categorize speech acts such that high level policies can be defined without going into specifics of the speech acts. This approach is independent of the syntax and semantics of the communication language and can be used for different agent communication languages. Our policy based framework can help in agent communication in three ways: (i) to filter inappropriate messages, (ii) to help an agent to decide which speech act to use next, and (iii) to prevent an agent from sending inappropriate messages. Our work differs from most existing research on communication policies because it is not tightly coupled to any domain information such as the mental states of agents or specific communicative acts. Contributions of this work include: (i) an extensible framework that is applicable to varied domain knowledge and different agent communication languages, and (ii) the declarative representation of conversation specifications and policies in terms of permitted and obligated speech acts.     

Flexible secure inter-domain interoperability through attribute conversion

The access control policy of an application that is composed of interoperating components/services is defined in terms of the access control policies enforced by the respective services. These individual access control policies are heterogenous in the sense that the services may be independently developed and managed and it is not practical to assume that all policies are defined with respect to some uniform domain vocabulary of policy attributes. A framework is described that provides a domain mapping for heterogenous policies. A fuzzy-based conversion mechanism determines the degree to which an access control attribute of one (service) policy may safely interoperate with an access control attribute of another (service) policy. The approach is scalable in the sense that it is not necessary to a priori specify every pairwise policy interoperation relationship, rather, where obvious interpretations exist then policy relationships are specified, while other relationships are inferred using the fuzzy mechanism.     

Trust structures

A general formal model for trust in dynamic networks is presented. The model is based on the trust structures of Carbone, Nielsen and Sassone: a domain theoretic generalisation of Weeks’ framework for credential based trust management systems, e.g., KeyNote and SPKI. Collections of mutually referring trust policies (so-called “webs” of trust) are given a precise meaning in terms of an abstract domain-theoretic semantics. A complementary concrete operational semantics is provided using the well-known I/O-automaton model. The operational semantics is proved to adhere to the abstract semantics, effectively providing a distributed algorithm allowing principals to compute the meaning of a “web” of trust policies. Several techniques allowing sound and efficient distributed approximation of the abstract semantics are presented and proved correct. BRICS: Basic Research in Computer Science (www.brics.dk) funded by the Panish National Research Foundation.     

easyABMS: A domain-expert oriented methodology for agent-based modeling and simulation

Agent-Based Modeling and Simulation (ABMS) has arisen as new approach to effectively support domain experts to cope with the growing complexity of the problems which they have to face and solve. To date, few methodologies are available which can be exploited by domain experts with limited programming expertise to model and subsequently analyze complex systems typical of their application domains. In this paper the easyABMS methodology is proposed to overcome the lack of integrated methodologies able to seamlessly guide domain experts from the analysis of the system under consideration to its modeling and analysis of simulation results. The effectiveness of easyABMS is also experimented through a case study in the logistics domain which concerns the analysis of different policies for managing vehicles used for stacking and moving containers in a transhipment terminal.