基于层次角色的受限委托模型及模拟分析

Hierarchical Role-based Restricted Delegation Model and Simulation Analyzing

在分布式应用环境中,多个安全域间授权的委托关系极为普遍。针对实际应用中对委托限制多方面需求的实际,在已有工作的基础上,提出了基于层次角色的受限委托模型HRRDM。模型通过定义角色树来解决部分委托问题,利用委托传播树和角色委托链来解决委托传播限制问题和委托传播的依赖性问题,提出了用委托凭证来支持层次角色委托的临时性,关联性、部分性、传播性限制的需求,并有效地支持了委托角色授予与撤销的动态特性。最后对HRRDM的扩展执行模型进行了形式化描述和证明,并对该执行模型进行了有效模拟分析,证实了其有效与简捷性。

In distributed environments, delegation relationships across multiple security domains are ubiquitous. To satisfy various restricted delegation requirements of actual applications, on the basis of the existing works, a Hierarchical Role-based Restricted Delegation Model （HRRDM） was proposed. The role tree was defined to solve the partial delegation problem, and the delegation spread tree and the role delegation chain were defined to solve the multi-step delegation problem and the problem of multi-step delegation dependency respectively. The delegation certification was proposed to support requirements of temporary delegation, associated role delegation, partial delegation, multi-step delegation in actual applications, and the dynamic characteristic of delegation role granting or revocation was effectively supported. Finally, the extensive execution model of HRRDM was formalized and proved, and the simulation analyzing of the execution model was given to validate its availability.