摘要
基于属性的声明式策略语言XACML表达能力丰富,满足开放式环境下资源访问管理的复杂安全需求,但其自身缺乏对规则冲突检测、规则冗余分析的支持.文中利用规则状态思想描述分析了属性层次操作关联带来的多种冲突类型,在资源语义树策略索引基础上利用状态相关性给出规则冲突检测算法;利用状态覆盖思想分析造成规则冗余的原因,给出在不同规则评估合并算法下的冗余判定定理.仿真实验首先分析了冲突检测算法的运行效率;然后针对多种策略判定系统,验证了基于语义树的策略索引和冗余规则处理可以显著提高判定性能.
XACML is a kind of declarative policy language which has flexible expressive functions based on attributes and satisfies complex security requirements of access management in the open environment, but it lacks the capabilities of detecting conflict rules and analyzing rule redundancy. This paper proposes rule state concept and applies it to analyze several categories of rule conflict caused by attribute hierarchy. In order to detecting and locating these conflicts, resource semantic tree and state relativity are utilized for depicting conflict detecting algorithms. Besides that, rule redundancy is the other issue in this paper. Employing state covering method, the mechanism of rule redundancy is explained, and redundancy judgment theorems are proven for various rules combining algorithms. The emulation tests in the last part of this paper firstly analyze the algorithm＇s efficiency, secondly indicate that evaluation performance can profit from resource semantic tree index and redundancy disposing.
出处
《计算机学报》
EI
CSCD
北大核心
2009年第3期516-530,共15页
Chinese Journal of Computers
基金
国家"八六三"高技术研究发展计划项目基金(2006AA01Z454)
国家科技支撑计划项目基金(2006BAH02A02)
国家自然科学基金(60603017)资助~~
