分布式应用访问控制策略精化冲突研究.docVIP

分布式应用访问控制策略精化冲突研究 　　摘 要： 随着云技术的发展，分布式应用平台朝着弹性资源和环境动态变迁的方向发展。分布式应用访问控制策略精化计算与资源和环境相关，也需要较强的性能与这种动态性相适应。现有的访问控制策略空间冲突分析方法虽然可以用于分布式访问控制策略精化中的策略冲突分析，但是该类算法以权限赋值单元为单位计算，计算粒度过细导致性能较低。提出了基于集合求交递推算法，以权限赋值单元集合为单位计算策略冲突来提高计算粒度。理论分析与实验结果表明该算法具有较高性能， 适用于云平台策略精化计算的高性能的需求。 关键词：访问控制；分布式；策略精化；策略冲突分析 中图分类号： TP309.2 文献标志码：A Conflict analysis of distributed application access control policies refinement With the growth of cloud technology， distributed application platform develops towards elasticity resources and dynamic migration environment. The refinement of distributed application access control policies was associated with resources and environment， which also needs to improve performance to adapt to the dynamics. Although present access control space policies conflict analysis methods could be used in the conflict analysis of distributed application access control policies refinement. The granularity of its calculating unit is too fine to make batter performance. In this article， the authors designed a conflict analysis algorithm used in distributed application access control policies refinement， the conflict analysis algorithm was based on recursive calculation the intersection of sets and the calculation unit of the algorithm was permission assignment unit which improved computing granularity. The experimental results and analysis show that the proposed algorithm has better performance， and fits the needs of improving computing performance of cloud platform access control policies refinement. Key words： access control； distributed； policy refinement； policy conflict analysis 0 引言 面向服务架构（Service Oriented Architecture，SOA）、服务云（Software as a Service，SaaS）是分布式技术新发展，目标是解决系统实现复杂性，实现商业应用需求到IT产品的构建和配置。基于模型逐层细化的模型驱动架构（Model Driven Architecture，MDA）方法[1]是其中重要方法。 策略是面向服务应用安全管理的关键[2]。以MDA系统分层和各层对象为策略描述对象，通过映射规则，将上层抽象的访问控制策略转化为下层具体的访问控制策略的过程称为策略精化[3-5]。面向服务计算需要服务品质协议（Service-Level Agreement，SLA）的呈现[6]，访问控制抽象策略到配置策略之间的精化关系是访问控制SLA的呈现。 策略精化需要满足：完全性，即所