网络环境下基于PKI与访问控制的身份代理算法

AN IDENTITY PROXY ALGORITHM BASED ON PKI AND ACCESS CONTROL IN NETWORK ENVIRONMENT

本文介绍了一个适用于网络分布式环境的身份代理算法。采用基于离散对数问题的公钥密码体系生成身份代理数字证书涉及的密钥对。该研究结合基于角色的访问控制与公钥基础设施(PKI),设计了一个安全的、易于配置与管理、独立于程序的信息访问控制策略。与传统的基于用户和口令的访问控制方案比较,基于角色的访问控制能明显地简化网络分布式系统的安全管理。使用关联角色访问控制的身份代理证书为系统内受控的用户角色转换提供了很大的灵活性。

This paper presents an identity proxy algorithm suitable for distributed network environment.The key pair related to identity proxy certificate is generated by a public-key cryptosystem based on discrete logarithm problem.A secure,easy to configure and manage,independent of program information access control policy is designed by combining RBAC(role based access control)with PKI(public key infrastructure).In comparison with the conventional user and password based approach,RBAC can obviously simplify the security management of distributed network system.The identity proxy certificate associating RBAC provides great flexibility for controlled transfer of user's role in the system.