一个基于逻辑的存取控制模型

A Logic Based Access Control Model

在任何一个安全系统中,存取控制都是一个极为重要的问题。本文提出一个基于逻辑程序设计的方法来管理非集中式的授权及其代理。在这个系统中,允许用户代理管理权限、授权或禁止其他用户使用某些存取权限。给出一组独立于论域的规则来实现代理正确性、解决冲突和沿着主体、客体及存取权限层次结构的授权传递,其基本思想是将这些一般规则与用户定义的一组与论域相关的特殊规则结合起来,以推导出系统中成立的所有授权。此外,还给出一些语义性质。

Access control is needed in any system where the resources are shared by different users. In this paper, we develop a logic based approach for decentralized authorization management in which users are delegated, granted or forbidden some access rights. A set of general logic rules are provided to handle the delegation correctness, conflict resolution and authorization propagation along the hierarchies of subjects, objects and access rights. By combining these general rules with application-specific rules defined by users, we can derive the authorizations holding in the system, In addition, some semantic properties are further investigated.