在RBAC模型中“责权分离约束”的冲突检测与消解

Conflict Checking and Solving of Separation of Duty Constraints in RBAC

详细论述了责权分离约束在基于角色的访问控制(RBAC)中的冲突检测与解决方案。研究了该约束在“权限-角色授权”(PRA)、“权限-主体授权”(PSA)、“角色-主体授权”(RSA)、“角色-角色授权”(RRA)等各类授权关系中的典型示例,并结合数学中的有向图理论给出冲突检测的算法分析,为实际应用奠定了基础。此外,还对冲突产生后的消解方法进行了深入讨论,总结出多种方案并进行仿真比较,根据实验结果给出一套优化后的解决途径。

The conflict checking and solving of separation of duty constraints were particularly discussed in RBAC we researched these constraints＇ typical examples in authorization relations of the permission-to-role assignment （PRA）, the permission-to subject assignment （PSA）, the role-to-subject assignment （RSA）, and the definition of a role hierarchy （role-to-role assignment, RRA）. The arithmetic analysis of conflict checking which links with the theory of directed acycline graph （DAG） was provided. It will be a basis for practicall application. Furthermore, the conflict solving was further discussed in the paper. Several schemes are summarized and achieved imitating experiment. Subsequently, we provided an optimized solving method for the further work.