PMI授权管理系统设计与实现

Design and Implementation for Authorization Management System Based on PMI

企业的安全应用面临着资源信息需共享,跨组织边界的用户和服务资源会随时调整,安全策略中的安全属性种类繁多,权限决策辅助因素的多变等问题。文中介绍的PMI授权管理系统为上述问题提供了一个可行的解决方案。该系统将GB/T 16264.8-2005和ISO/IEC 9594-8(2005)相结合,遵循属性证书的X.509协议,利用改进的RBAC模型建立授权机制,将各类权限信息存储在LDAP数据库及属性证书中。应用结果表明,系统将访问控制机制从具体应用的开发和管理中分离出来,不仅屏蔽了安全技术的复杂性,也拥有很强的灵活性、适应性和可扩展性。文中给出了系统总体设计、授权体系与访问控制模型及LDAP数据库设计方案。

Enterprise applications face the following security problems： the sharing of resource information, the adjustment of the users and services across the boundaries, the large variety of properties in security policies and the polymorphic of factors in privilege decision support. In this paper, introduce a practical authorization management system based on PMI. It combines GB / T 16264.8-2005 and ISO / IEC 9594-8 （2005 }, and follows the X. 509 attribute certificate protocol. It stores the authorization information in LDAP and attribute certifications through the improved RBAC model to isolate the access control model from the applications. It encapsulates the complexity of security technology that ensures the flexibility, adaptability and scalability of the system. The design of the system, the authorization model, the access control model and the LDAP database are also given in the paper.