支持组和属性层级的基于属性的访问控制模型

Attribute-based Access Control Model with GroupHierarchy and Attribute Hierarchy Support

基于属性的访问控制(attribute-based access control,ABAC)机制越来越受到学术界和工业界的重视,因其灵活的策略定义和动态的授权决定能力.但目前ABAC存在着属性分配与管理、策略创建工作量大的问题.基于组层级和属性层级的ABAC模型(称作GHAHABAC),通过引进组层级和属性值层级,实现属性值和访问权限的继承,从而减少属性分配和策略规则构建的工作量.给出GHAHABAC模型的形式化定义,通过应用实例说明了模型的可用性.

Attribute-based access control （ ABAC） mechanism is drawing great attention from both recentacademic and industry world because of its flexible policy specification and dynamic authorization decision-makingcapabilities. However the workloads of attribute assignment, attribute management and policy establishing relating tocurrent ABAC is very heavy, a group hierarchy and attribute value hierarchy based ABAC model with constraintssupport （called GHAHABAC） was proposed in this paper. By introducing both group hierarchies and attributevalue hierarchies, HGCABAC model achieves the attribute-value inheritance and access rights inheritance, andfinally simplifies attribute assignment and policy establishing tasks. Not only the formal specification of HGCABACmodel is provided, but also its usefulness is demonstrated with the several application examples.