2基于角色的受限委托模型.doc

 PAGE 978 Journal of Software 软件学报 2005,16(5)??? 徐震 等:基于角色的受限委托模型  PAGE 977 Vol.16, No.5 ?2005 Journal of Software 软 件 学 报 1000-9825/2005/16(05)0970 基于角色的受限委托模型? Supported by the National Natural Science Foundation of China under Grant Nos(国家自然科学基金); the National High-Tech Research and Development Plan of China under Grant No.2004AA147070 (国家高技术研究发展计划(863)); the National Grand Fundamental Research 973 Program of China under Grant No.G1999035802 (国家重点基础研究发展规划(973)) 作者简介: 徐震(1976－),男,山东昌邑人,博士生,主要研究领域为大型网络和信息系统安全;李斓(1977－),男,博士生,主要研究领域为大型网络与信息系统安全;冯登国(1966－),男,博士,研究员,博士生导师,主要研究领域为密码学,信息安全. 徐 震+, 李 斓, 冯登国 (中国科学院 软件研究所 信息安全国家重点实验室,北京 100080) A Constrained Role-Based Delegation Model XU Zhen+, LI Lan, FENG Deng-Guo (State Key Laboratory of Information Security, Institute of Software, The Chinese Academy of Sciences, Beijing 100080, China) + Corresponding author: Phn: +86-10 E-mail: xuzhen@, Received 2003-11-20; Accepted 2004-08-10 Xu Z, Li L, Feng DG. A constrained role-based delegation model. Journal of Software, 2005,16(5):970?978. DOI: 10.1360/jos160970 Abstract: Delegation is an important security policy that should be supported by RBAC model. The basic idea of delegation is that some active entity in a system delegates authority to another active entity to carry out some functions on behalf of the former. The grantor of the delegated roles should be responsible for the usage of them, so constraints on the usage of the delegated roles are critical components of the whole delegation model. Currently, there’re some models that extend RBAC model to support role delegation. However, their supports for constraints on the usage of delegated roles are very limited. This paper presents the requirements of role-based delegation, including temporary constraints, regular role dependency constraints, partial delegation constraints and propagation constraints. The former two kinds of constraints are modeled with a formal model – CRDM,