受限环境下基于权能的访问控制研究.PDF

优先出版 计 算 机 应 用 研 究 第33 卷 受限环境下基于权能的访问控制研究* 沈海波，陈 强，陈勇昌 (广东第二师范学院 计算机科学系，广州 510303) 摘 要：针对资源受限环境对认证和访问控制提出的轻载性、灵活性、基于局部条件的访问策略和端到端的安全性等特 殊要求进行了分析和研究，基于拥有证明 (proof-of-possession ，PoP) 安全机制并通过构造 PoP 权能令牌，提出了一种 基于权能的访问控制架构。该架构将资源花销较大的授权决策工作外包给资源不受限的可信第三方节点，而授权决策的 执行和局部条件的评估则由受限的充当资源服务器的设备来处理，以实现利用少受限节点帮助受限节点完成与授权相关 的任务；并利用PoP 权能令牌实现了客户端到资源服务器的认证，解决了客户端与资源服务器的安全通信问题；并通过 实验验证了所提方法的可行性。还从实际应用的角度，详细讨论了 PoP 权能令牌的构造方法、与 PoP 密钥的绑定机制 以及基于PoP 权能令牌的客户端认证过程。 关键词：受限环境；权能；拥有证明；认证；访问控制 中图分类号：TP309.2 Capability-based access control for constrained environments Shen Haibo, Chen Qiang, Chen Yongchang (Dept of Computer Science, Guangdong University of Education, Guangzhou 510303, China) Abstract: In view of the special needs of lightweight, flexibility, access policies based on local conditions and end-to-end security in the constrained environments, this paper proposed a capability-based access control framework based on the Proof-of-Possession (PoP) security mechanism and the constructing of PoP capability token. The proposed framework outsources authorization decision making to an unconstrained, trusted third party while performing authorization decision enforcement and verification of local conditions in constrained devices acting as a resource server, so as to help constrained nodes with authorization-related tasks via less-constrained nodes. And this framework resolves the secure communication problem between client and resource server by authenticating the client to