Web服务中的基于快速信任的访问控制模型

OASIS的WEB服务安全规范，不提供信任评估和授权决策的支持。文中针对于Web服务下，虚拟临时组织中的访问控制和授权，设计了一种基于怏速信任的访问控制模型（WS—STBAC，SwiftTrust—Based Access Control for Web Service），一种与认证中心相类似的中间件。WS—STBAC南策略管理、信任度计算和授权决策3个模块组成。在获得提供方的访问控制策略和信任计算所需的数据和算法之后，WS—STBAC计算对请求方的信任度。并根据访问控制策略，代替服务提供方进行授权决策。

A swift-trust-based access control of Web service

The Web service security standards of OASIS can not support trust evaluation and decision-making using trust information. In this paper, in order to solve access control and authorization in virtual temporary team of web service, a SwiftTrust-Based Access Control for Web Service （WS-STBAC） is designed. WS-STBAC is a kind of middleware like authentication center, and composed of three modules： policy management, trust value computing, and decision-making of authentication. Receiving access control policy, Algorithm and datum about trust computing from providers, WS-STBAC computes trust value of requestors. And based on policy, WS-STBAC decides whether to give requestors authorization, instead of providers.