基于行为能力结构的域间动态授权管理模型

General Inter-Domain Dynamic Authorization Management Model Based on Action Capability

综合角色访问控制模型和属性访问控制模型的各自优势,基于粒逻辑基本原理,提出了一个基于行为能力结构的域间动态授权管理模型(GiDAAMM)。基于行为能力粒结构角色定义、岗位要求、时间约束、行为判定、可信环境等综合子粒因素的关联分析,探讨了行为能力的层次结构与权限分配模式,给出了GiDAAMM模型的行为能力约束规则、授权规则与策略关系,完成了GiDAAMM模型的形式化描述和相关安全定理证明。GiDAAMM模型不仅能进一步细化访问控制粒度,优化授权策略管理,增强系统的实用性,并且能提供完善的系统保护,有效降低威胁风险。

A general inter-domain dynamic authorization management model based on action capability（GiDAAMM） is presented according to the basal principle of theory granular logic and integrates the merits of both RBAC and ABAC.The hierarchy and the permit assignment of the action capability are discussed,and the restricting regulation,authorization regulation,policy relation of the action capability in the GiDAAMM are extended based on the correlative analyses of the role definition,station request,time restriction,action determinant,credible environment and other integrative granule factors in the action capability granule.The formalized description and correlation secure theorem is proved,and the GiDAAMM is analyzed compared to other interrelated authorization management models.The model makes the access control more precise,optimizes the authorization policy management,improves the practicability of the system,and extends the application area of security model.It also perfectly protects the system,reduces the threat risk.