具有特征判断能力的使用控制模型研究

Usage Control Model with the Ability of Character Judging

传统访问控制的研究重点是授权策略,关注的是如何为主体分配权限以及如何限制主体使用分配得到的权限。目前绝大多数访问控制策略仍无法识别与控制具有访问权限的非法用户。在分析传统访问控制策略不足的基础上,提出了一种基于UCON的具有访问特征判断能力的使用控制模型——C-UCON。该模型通过在UCON的基础上引入既定义务、待定义务、即定条件、待定条件以及特征和激活规则来对访问进行主观判断,从而降低或者排除具有访问权限的非法用户所带来的安全威胁。

The emphases of traditional access control studying is the policy of authorization, the studying is focus on how to distribute permissions to subject and how to restrict the using of these permissions. Based on the analysis of traditional access control,we introduced a new mode, C_UCON, which is based on the UCON and has the ability to judge the character of accessing. By introducing assure obligations, unsure obligations, assure conditions, unsure conditions, characters and active rules, the C UCON has the ability to judge accessing subjectively, thereby reduce or exclude those threats from the illegal users who has permission.