CN102387145B - System and method for detecting access control strategy collision in collaborative environment - Google Patents
System and method for detecting access control strategy collision in collaborative environment Download PDFInfo
- Publication number
- CN102387145B CN102387145B CN201110322928.8A CN201110322928A CN102387145B CN 102387145 B CN102387145 B CN 102387145B CN 201110322928 A CN201110322928 A CN 201110322928A CN 102387145 B CN102387145 B CN 102387145B
- Authority
- CN
- China
- Prior art keywords
- access control
- role
- strategy
- control policy
- policy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Abstract
The invention discloses a system and a method for detecting access control strategy collisions in a collaborative environment. Firstly the problem of semantic isomerism of access control strategy used by each region in the collaborative environment among mutually-operated regions based on role mapping is solved, and on the basis, the problem of the access control strategy collisions in the collaborative environment is solved; therefore, the system and the method are particularly suitable for use in a collaborative environment with semantic isomerism. The technology adopts an improved strategy integration algorithm based on semantic integration and a strategy collision detection algorithm based on subgraph isomorphism as main algorithms. The main activities of the detection technology for the access control strategy collision in the collaborative environment comprise strategy pre-processing, multi-region strategy integration and strategy collision detection activity. The invention can detect the access control strategy collisions caused by mutual operation among regions by role mapping, so as to avoid the safety problems of unauthorized access and the like.
Description
Technical field
The present invention relates to access control policy collision detection system and method in a kind of cooperative surroundings, belong to computer network security field.
Background technology
In the cooperative surroundings of most of reality, developer or manager do not think to abandon completely existing rights management and Access Control System, wish between mandate opening and system reform cost, keep balance and take into account.Between the territory based on role's mapping, interoperability can effectively avoid revising the maintenance cost that a large amount of access control policies brings, strengthen the convenience of cooperating with Modes of Sharing Resources between cross-domain tissue, reduce the managing risk of authorizing system isomery and user to increase sharply and bring under cross-domain environment, therefore between the territory based on role's mapping, interoperability becomes research field representative in cooperative surroundings field gradually, is also research background of the present invention.
Yet on the one hand, increase along with information and data access demand, people more and more pay close attention to the safety of data and private ownership, therefore between the territory based on role's mapping in interoperability cooperative surroundings, the access control policy that each domain administrator is formulated is even more important, if go wrong, will directly cause the unauthorized access of Autonomous Domain resource.On the other hand, different Autonomous Domains may be described access control policy separately with different semantemes, and between each Autonomous Domain, carry out interoperability at present and the role shone upon still may exist the authority that role's mandate is needed than role many or few, this can not be avoided completely, the inconsistent generation that will cause each autonomous domain browsing control strategy collision problem of the actual role's of authorizing authority and the required authority of role, finally causes the unauthorized access to Autonomous Domain resource.And most does not consider about the research of policy conflict the access control policy Semantic Heterogeneous problem that same area is not formulated, can not effectively detect conflict, user does not realize clearing up conflict like this, make the safety problems such as unauthorized access be easy to occur, cause computer network system fail safe to reduce.
Summary of the invention
Technology of the present invention is dealt with problems: overcome the deficiencies in the prior art, access control policy collision detection system and method in a kind of cooperative surroundings is provided, can more effective detection conflict, prevent that the safety problems such as unauthorized access are easy to occur, greatly improved computer network system fail safe.
Technical solution of the present invention: access control policy collision detection system in a kind of cooperative surroundings, is characterized in that comprising: access control policy pretreatment module, multiple domain strategy integration module and policy conflict detection module, wherein:
Access control policy pretreatment module: by the strategy file in two territories that adopt XACML to describe, be that access control policy in the B domain policy file described of the A domain policy file described of XACML and XACML carries out grammatical and semantic parsing, when access control policy is resolved, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set, described access control policy ordered set is delivered to multiple domain strategy integration module; Described territory is the basic composition unit of cooperative surroundings, the tissue that the control strategy that independently conducts interviews in cooperative surroundings is formulated and managed; Described access control policy is the rule set of constraint main body to resource operation authority; Described main body is divided into user and role; Described resource comprises ftp server, web server, mail server and file server; Described operating right comprises reading and writing, execution and combination thereof; Described access control policy ordered set comprises role succession strategy, direct delegated strategy and user and assigns strategy; Described role succession strategy refers to the access control policy of the operating right of stipulating certain another role of role succession, form turns to five-tuple (strategy names, ' < ', role 1, role 2, sequence number), role 1 has inherited role 2 authority, the inheritance between ' < ' symbology role; Described role succession strategy is divided into again this territory role succession strategy and crosses over role's mapping policy, role 1 and role 2 in this territory role succession strategy belong to this territory, the role 1 who crosses in role's mapping policy belongs to another territory (being foreign lands), and role 2 belongs to this territory; Described direct delegated strategy refers to the access control policy of constraint role to resource operation authority, form turns to hexa-atomic group of (strategy names, constraint, role, resource, operating right, sequence number), constraint is divided into permission, refusal, other roles of Role including administrator role and system definition, resource comprises ftp server, web server, mail server and file server, and described operating right is divided into reading and writing, execution and combination thereof; Described direct delegated strategy is divided into again the direct delegated strategy in this territory and cross-domain direct delegated strategy, and role and resource in the direct delegated strategy in this territory all belong to this territory, and the role in cross-domain direct delegated strategy belongs to this territory, and resource belongs to foreign lands; Described user assigns strategy to refer to user is assigned to role, and has the access control policy of all authorities of role, and form turns to five-tuple (strategy names is assigned user, role, sequence number); Described strategy names refers to the title rising for strategy when policy development person generates strategy, and is the form of character string; Described role refers to the base unit that can directly have authority, is divided into other roles of administrator role or keeper's definition; Described user refers to the user of resource; Described appointment refers to the appointment relation between role-and-user, and the right assignment that soon role has, to user, makes user have the authority that role has; Described sequence number refers to tactful unique number;
Multiple domain strategy integration module: access control policy ordered set access control policy pretreatment module being obtained according to the access control policy element property in access control policy ordered set is screened, obtain with territory between the relevant access control policy of interoperability, and in conjunction with initial policy body, generate the local ontology in two territories, described local ontology is passed through to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to Semantic mapping to local ontology being converted to overall body, obtain global access control strategy, and global access control strategy is delivered to policy conflict detection module, described access control policy element property refers to that access control policy element belongs to this territory L or belongs to another one territory F, described L is that this access control policy element of explanation belongs to this territory, described F illustrates that this access control policy element belongs to another territory, and just quote it in this territory, described initial policy body is two common bodies that territory is known in cooperative surroundings, described common body i.e. the clear and definite Formal Specification explanation to the shared access control policy model in two territories, only comprises the relationship of the concepts of access control policy element, described access control policy element comprises user, role, resource, reading and writing, execution, permission, refusal, inheritance, appointment relation, described access control policy element refers to the abstractdesription of described access control policy element, the concept instantiation of access control policy element has just been formed to the example of access control policy element, i.e. the specific descriptions to access control policy element, described local ontology refers to that the access control policy element example using in each territory is different, the access control policy element example that each territory is used is separately in conjunction with common body recited above, the body that has formed each territory oneself, i.e. local ontology, there is the local ontology of oneself in each territory, described overall body is that the access control policy element example that each territory is used is united, then in conjunction with described common body, has formed the total overall body in each territory, described global access control strategy refers to role succession strategy between the territory that does not have Semantic Heterogeneous problem,
Policy conflict detection module: the access control policy ordered set that access control policy preliminary treatment is obtained is screened, and the global access control strategy obtaining in conjunction with multiple domain strategy integration module, imply analysis of strategies, obtain access control policy implicit in cooperative surroundings, by access control policy ordered set, global access control strategy and implicit access control policy are converted to the form of policy map, conflict rule is converted to the form of conflict graph simultaneously, according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and described every paths is mated with the path in conflict graph, if the match is successful, there is conflict, and obtain conflict type and reason, by reverse strategy, inquire about, according to the unique identification-sequence number of the access control policy leading to a conflict, search the strategy names in input policing file of its correspondence, the conflict source policy position at place of this strategy names, and generate conflict analysis report and be shown to user, if mate unsuccessfully, there is not conflict, and show dialog box prompting user,
Described policy map full name is access control policy figure, soon user, role and the resource in access control policy is as the node of figure, limit using direct delegated strategy as role and between resource, limit using role succession strategy as role and between role, user is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as policy map; Described conflict rule is the form of IF-Then, and the former piece that IF statement is conflict rule has been described policy conflict the condition possessing is occurred, and the consequent that Then statement is conflict rule, has described the type of conflicting; Described conflict graph is the node using the user in the access control policy clashing, role and resource as figure, limit using the direct delegated strategy clashing between role and resource, limit using the role succession strategy clashing between role and role, the user who clashes is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as conflict graph.
Described multiple domain strategy integration module implementation procedure is as follows:
(1) according to the access control policy attribute of an element in access control policy ordered set, be F or L, access control policy ordered set is screened, according to the access control policy element property in access control policy ordered set, be F or L, access control policy in access control policy ordered set is traveled through, when the access control policy element property traversing is F, the access control policy that this access control policy element place is described be with territory between the relevant access control policy of interoperability, these strategies are saved, just obtain with territory between the relevant access control policy of interoperability,
(2) take the initial policy body that comprises access control policy element concept and the relationship of the concepts as basis, the policy elements in the access control policy filtering out is added under the concept that initial policy body is corresponding, form respectively the local ontology in two territories;
(3) local ontology is carried out to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to the body construction of two local ontology, relation between instance name and access control policy element in body, calculate respectively in two local ontology degree of approximation value between corresponding role instance and the degree of approximation value between resource example, two degree of approximation values obtain total degree of approximation value after being weighted summation, two roles that degree of approximation value the greater is corresponding are the Semantic mapping pair between access control policy element example, two roles of Semantic mapping centering are added as an example under role conception corresponding in initial policy body simultaneously, obtain overall body,
(4) according to the sign sequence number before access control policy element example, search in overall body the example of corresponding same sequence number under each concept, each example is combined, form global access control strategy.
Described policy conflict detection module implementation procedure is as follows:
(1) according to the access control policy attribute of an element in access control policy ordered set, be ' F (Foreign) ' or ' L (Local) ', access control policy ordered set is screened, remove with territory between the relevant access control policy of interoperability, be that attribute is the access control policy of ' F (Foreign) ', obtain the access control policy that attribute is ' L (Local) ', comprise the direct delegated strategy in this territory, this territory role succession strategy and user to assign strategy;
(2) in conjunction with the direct delegated strategy in this territory, this territory role succession strategy, the user that filter out, assign strategy, and the global access control strategy that obtains of multiple domain strategy integration module, according to the transfer of right relation between the role of this territory role succession strategy and the description of cross-domain role's mapping policy, analyze the authority that role or user have indirectly, implicit authority, obtains implicit access control policy;
(3) by the implicit access control policy obtaining, in conjunction with the direct delegated strategy in this territory, this territory role succession strategy, user, assign strategy and global access control strategy, extract role wherein and resource as the node of figure, using above-mentioned strategy as limit, forming strategies figure;
(4) read conflict rule, by every conflict rule, extraction user, role and resource is wherein as the node of figure, limit using direct delegated strategy wherein between role node and resource node, limit using role succession strategy wherein between role node and role node, assigns the limit of strategy between user node and role node using user wherein, is converted to the form of figure, form conflict graph, in each conflict graph, comprise a paths;
(5) according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and every paths is mated with the path in each conflict graph, if the match is successful, there is conflict in explanation, according to the conflict graph type that the match is successful, draws the conflict type and the conflict reason that in policy map, clash, if mate unsuccessfully, directly generation does not exist the dialog box of conflict to be shown to user;
(6) after route matching success, according to the strategy correspondence at this place, path in sequence number reverse find policy map at input policing file, it is the strategy names in the A domain policy file of XACML description and the B domain policy file of XACML description, the conflict source policy position at place of this strategy names, by the source policy position at the conflict place obtaining, together with the conflict type drawing in step (5) and conflict reason, generate conflict analysis report and be shown to user.
In cooperative surroundings, access control policy collision detection method performing step is as follows:
(1) by the strategy file in two territories that adopt XACML to describe, be that access control policy in the B domain policy file described of the A domain policy file described of XACML and XACML carries out grammatical and semantic parsing, when access control policy is resolved, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set, described access control policy ordered set is delivered to multiple domain strategy integration module; Described territory is the basic composition unit of cooperative surroundings, the tissue that the control strategy that independently conducts interviews in cooperative surroundings is formulated and managed; Described access control policy is the rule set of constraint main body to resource operation authority; Described main body is divided into user and role; Described resource comprises ftp server, web server, mail server and file server; Described operating right comprises reading and writing, execution and combination thereof; Described access control policy ordered set comprises role succession strategy, direct delegated strategy and user and assigns strategy; Described role succession strategy refers to the access control policy of the operating right of stipulating certain another role of role succession, form turns to five-tuple (strategy names, ' < ', role 1, role 2, sequence number), role 1 has inherited role 2 authority, the inheritance between ' < ' symbology role; Described role succession strategy is divided into again this territory role succession strategy and crosses over role's mapping policy, role 1 and role 2 in this territory role succession strategy belong to this territory, the role 1 who crosses in role's mapping policy belongs to another territory (being foreign lands), and role 2 belongs to this territory; Described direct delegated strategy refers to the access control policy of constraint role to resource operation authority, form turns to hexa-atomic group of (strategy names, constraint, role, resource, operating right, sequence number), constraint is divided into permission, refusal, other roles of Role including administrator role and system definition, resource comprises ftp server, web server, mail server and file server, and described operating right is divided into reading and writing, execution and combination thereof; Described direct delegated strategy is divided into again the direct delegated strategy in this territory and cross-domain direct delegated strategy, and role and resource in the direct delegated strategy in this territory all belong to this territory, and the role in cross-domain direct delegated strategy belongs to this territory, and resource belongs to foreign lands; Described user assigns strategy to refer to user is assigned to role, and has the access control policy of all authorities of role, and form turns to five-tuple (strategy names is assigned user, role, sequence number); Described strategy names refers to the title rising for strategy when policy development person generates strategy, and is the form of character string; Described role refers to the base unit that can directly have authority, is divided into other roles of administrator role or keeper's definition; Described user refers to the user of resource; Described appointment refers to the appointment relation between role-and-user, and the right assignment that soon role has, to user, makes user have the authority that role has; Described sequence number refers to tactful unique number;
(2) the access control policy ordered set according to the access control policy element property in access control policy ordered set, step (1) being obtained is screened, obtain with territory between the relevant access control policy of interoperability, and in conjunction with initial policy body, generate the local ontology in two territories, described local ontology is passed through to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to Semantic mapping, to local ontology being converted to overall body, obtain global access control strategy; Described access control policy element property refers to that access control policy element belongs to this territory L or belongs to another one territory F; Described L is that this access control policy element of explanation belongs to this territory; Described F illustrates that this access control policy element belongs to another territory, and just quote it in this territory; Described initial policy body is two common bodies that territory is known in cooperative surroundings; Described common body i.e. the clear and definite Formal Specification explanation to the shared access control policy model in two territories, only comprises the relationship of the concepts of access control policy element; Described access control policy element comprises user, role, resource, reading and writing, execution, permission, refusal, inheritance, appointment relation; Described access control policy element refers to the abstractdesription of described access control policy element, the concept instantiation of access control policy element has just been formed to the example of access control policy element, i.e. the specific descriptions to access control policy element; Described local ontology refers to that the access control policy element example using in each territory is different, the access control policy element example that each territory is used is separately in conjunction with common body recited above, the body that has formed each territory oneself, i.e. local ontology, there is the local ontology of oneself in each territory; Described overall body is that the access control policy element example that each territory is used is united, then in conjunction with described common body, has formed the total overall body in each territory; Described global access control strategy refers to role succession strategy between the territory that does not have Semantic Heterogeneous problem;
(3) access control policy ordered set step (1) being obtained is screened, and the global access control strategy that obtains of integrating step (2), imply analysis of strategies, obtain access control policy implicit in cooperative surroundings, by access control policy ordered set, global access control strategy and implicit access control policy are converted to the form of policy map, conflict rule is converted to the form of conflict graph simultaneously, according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and described every paths is mated with the path in conflict graph, if the match is successful, there is conflict, and obtain conflict type and reason, by reverse strategy, inquire about, according to the unique identification-sequence number of the access control policy leading to a conflict, search the strategy names in input policing file of its correspondence, the conflict source policy position at place of this strategy names, and generate conflict analysis report and be shown to user, if mate unsuccessfully, there is not conflict, and show dialog box prompting user,
Described policy map full name is access control policy figure, soon user, role and the resource in access control policy is as the node of figure, limit using direct delegated strategy as role and between resource, limit using role succession strategy as role and between role, user is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as policy map; Described conflict rule is the form of IF-Then, and the former piece that IF statement is conflict rule has been described policy conflict the condition possessing is occurred, and the consequent that Then statement is conflict rule, has described the type of conflicting; Described conflict graph is the node using the user in the access control policy clashing, role and resource as figure, limit using the direct delegated strategy clashing between role and resource, limit using the role succession strategy clashing between role and role, the user who clashes is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as conflict graph.
The present invention's advantage is compared with prior art:
(1) the present invention is by the interaction between access control policy pretreatment module, multiple domain strategy integration module and policy conflict detection module, make it possible to more effectively realize detect and conflict, prevent that the safety problems such as unauthorized access are easy to occur, greatly improved computer network system fail safe.
(2) the present invention has adopted multiple domain strategy integrated technology, consider the access control policy Semantic Heterogeneous problem in cooperative surroundings, and existing Semantic Integration has only been considered body construction, two factors of instance name, the present invention is except adopting these two factors, also adopted relation factor between access control policy element, while making to carry out Semantic mapping between the policy elements of isomery, its accuracy in detection is higher.
(3) the present invention has adopted policy conflict detection technique scheme, not only can detect conflict, more can navigate to accurately the tactful position at conflict place, and provide information such as conflict reason etc., facilitate user to take measures to carry out conflict resolution, and existing access control policy collision detection technology, major part is not also suitable for interoperability cooperative surroundings between the territory based on role's mapping, and the information providing aspect collision detection is limited, can only detect and whether have conflict, concrete conflict report is not provided, be unfavorable for that user takes further counter-measure to detected conflict.
Accompanying drawing explanation
Fig. 1 is system construction drawing of the present invention;
Fig. 2 is access control policy pretreatment module implementation procedure in the present invention;
Fig. 3 is tactful integration module implementation procedure in the present invention;
Fig. 4 is the uml diagram of initial policy body in the present invention;
Fig. 5 is tactful collision detection module implementation procedure in the present invention;
Fig. 6 is the division of access control policy in cooperative surroundings in the present invention.
Embodiment
As shown in Figure 1, in cooperative surroundings of the present invention, access control policy collision detection system consists of access control policy pretreatment module, multiple domain strategy integration module and policy conflict detection module.
Whole implementation procedure is as follows:
Access control policy pretreatment module: by the strategy file in two territories that adopt XACML to describe, be that access control policy in the B domain policy file described of the A domain policy file described of XACML and XACML carries out grammatical and semantic parsing, when access control policy is resolved, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set, described access control policy ordered set is delivered to multiple domain strategy integration module; Described territory is the basic composition unit of cooperative surroundings, the tissue that the control strategy that independently conducts interviews in cooperative surroundings is formulated and managed; Described access control policy is the rule set of constraint main body to resource operation authority; Described main body is divided into user and role; Described resource comprises ftp server, web server, mail server and file server; Described operating right comprises reading and writing, execution and combination thereof; Described access control policy ordered set comprises role succession strategy, direct delegated strategy and user and assigns strategy; Described role succession strategy refers to the access control policy of the operating right of stipulating certain another role of role succession, form turns to five-tuple (strategy names, ' < ', role 1, role 2, sequence number), role 1 has inherited role 2 authority, the inheritance between ' < ' symbology role; Described role succession strategy is divided into again this territory role succession strategy and crosses over role's mapping policy, role 1 and role 2 in this territory role succession strategy belong to this territory, the role 1 who crosses in role's mapping policy belongs to another territory (being foreign lands), and role 2 belongs to this territory; Described direct delegated strategy refers to the access control policy of constraint role to resource operation authority, form turns to hexa-atomic group of (strategy names, constraint, role, resource, operating right, sequence number), constraint is divided into permission, refusal, other roles of Role including administrator role and system definition, resource comprises ftp server, web server, mail server and file server, and described operating right is divided into reading and writing, execution and combination thereof; Described direct delegated strategy is divided into again the direct delegated strategy in this territory and cross-domain direct delegated strategy, and role and resource in the direct delegated strategy in this territory all belong to this territory, and the role in cross-domain direct delegated strategy belongs to this territory, and resource belongs to foreign lands; Described user assigns strategy to refer to user is assigned to role, and has the access control policy of all authorities of role, and form turns to five-tuple (strategy names is assigned user, role, sequence number); Described strategy names refers to the title rising for strategy when policy development person generates strategy, and is the form of character string; Described role refers to the base unit that can directly have authority, is divided into other roles of administrator role or keeper's definition; Described user refers to the user of resource; Described appointment refers to the appointment relation between role-and-user, and the right assignment that soon role has, to user, makes user have the authority that role has; Described sequence number refers to tactful unique number;
Multiple domain strategy integration module: access control policy ordered set access control policy pretreatment module being obtained according to the access control policy element property in access control policy ordered set is screened, obtain with territory between the relevant access control policy of interoperability, and in conjunction with initial policy body, generate the local ontology in two territories, described local ontology is passed through to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to Semantic mapping to local ontology being converted to overall body, obtain global access control strategy, and global access control strategy is delivered to policy conflict detection module, described access control policy element property refers to that access control policy element belongs to this territory L or belongs to another one territory F, described L is that this access control policy element of explanation belongs to this territory, described F illustrates that this access control policy element belongs to another territory, and just quote it in this territory, described initial policy body is two common bodies that territory is known in cooperative surroundings, described common body i.e. the clear and definite Formal Specification explanation to the shared access control policy model in two territories, only comprises the relationship of the concepts of access control policy element, described access control policy element comprises user, role, resource, reading and writing, execution, permission, refusal, inheritance, appointment relation, described access control policy element refers to the abstractdesription of described access control policy element, the concept instantiation of access control policy element has just been formed to the example of access control policy element, i.e. the specific descriptions to access control policy element, described local ontology refers to that the access control policy element example using in each territory is different, the access control policy element example that each territory is used is separately in conjunction with common body recited above, the body that has formed each territory oneself, i.e. local ontology, there is the local ontology of oneself in each territory, described overall body is that the access control policy element example that each territory is used is united, then in conjunction with described common body, has formed the total overall body in each territory, described global access control strategy refers to role succession strategy between the territory that does not have Semantic Heterogeneous problem,
Policy conflict detection module: the access control policy ordered set that access control policy preliminary treatment is obtained is screened, and the global access control strategy obtaining in conjunction with multiple domain strategy integration module, imply analysis of strategies, obtain access control policy implicit in cooperative surroundings, by access control policy ordered set, global access control strategy and implicit access control policy are converted to the form of policy map, conflict rule is converted to the form of conflict graph simultaneously, according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and described every paths is mated with the path in conflict graph, if the match is successful, there is conflict, and obtain conflict type and reason, by reverse strategy, inquire about, according to the unique identification-sequence number of the access control policy leading to a conflict, search the strategy names in input policing file of its correspondence, the conflict source policy position at place of this strategy names, and generate conflict analysis report and be shown to user, if mate unsuccessfully, there is not conflict, and show dialog box prompting user,
Described policy map full name is access control policy figure, soon user, role and the resource in access control policy is as the node of figure, limit using direct delegated strategy as role and between resource, limit using role succession strategy as role and between role, user is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as policy map; Described conflict rule is the form of IF-Then, and the former piece that IF statement is conflict rule has been described policy conflict the condition possessing is occurred, and the consequent that Then statement is conflict rule, has described the type of conflicting; Described conflict graph is the node using the user in the access control policy clashing, role and resource as figure, limit using the direct delegated strategy clashing between role and resource, limit using the role succession strategy clashing between role and role, the user who clashes is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as conflict graph;
The specific implementation process that further illustrates above-mentioned each module is below as follows:
1. access control policy pretreatment module
The implementation procedure of access control policy pretreatment module as shown in Figure 2.
(1) read the A domain policy file of XACML description and the B domain policy file that XACML describes.
(2) access control policy in the B domain policy file that the A domain policy file of XACML being described and XACML describe carries out grammatical and semantic parsing, when resolving, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set.
A) resolve the direct delegated strategy in access control policy.Extract every strategy names, constraint, role, resource and authority in direct delegated strategy, and adding sequence number as unique identification thereafter, form hexa-atomic group of direct delegated strategy (strategy names, constraint, role, resource, operating right, sequence number).
B) resolve the role succession strategy in access control policy.Extract every strategy names, inheritance, succession role, quilt in role succession strategy and inherited role, and adding sequence number as unique identification thereafter, form role succession strategy five-tuple (strategy names, ' < ', role 1, and role 2, sequence number).
C) user who resolves in access control policy assigns strategy.Extract every user and assign strategy names, appointment relation, user, the role in strategy, and adding sequence number as unique identification thereafter, form user and assign tactful five-tuple (strategy names is assigned user, role, sequence number).
D) assign tactful five-tuple to be stored in a file hexa-atomic group of the direct delegated strategy, role succession strategy five-tuple and the user that after resolving, form, form access control policy ordered set.
2, multiple domain strategy integration module
The implementation procedure of multiple domain strategy integration module as shown in Figure 3.
(1) multiple domain Integrated Strategy screening
According to the access control policy attribute of an element in access control policy ordered set, be F or L, the process that the access control policy ordered set that a upper module is obtained is screened, be the screening of multiple domain Integrated Strategy, according to the access control policy element property in access control policy ordered set, be F or L, access control policy in access control policy ordered set is traveled through, when the access control policy element property traversing is F, the access control policy that this access control policy element place is described be with territory between the relevant access control policy of interoperability, the access control policy relevant with interoperability between territory specifically comprises cross-domain direct delegated strategy and cross-domain role's mapping policy, when the access control policy traversing is while having the direct delegated strategy of F attribute, this direct delegated strategy is cross-domain direct delegated strategy, cross-domain direct delegated strategy belongs to a kind of of direct delegated strategy, also be the form of hexa-atomic group: (strategy names, constraint, role, resource, authority, sequence number), when the access control policy traversing is while having the role succession strategy of F attribute, this role succession strategy is cross-domain role's mapping policy, cross-domain role's mapping policy belongs to a kind of of role succession strategy, also be the form of five-tuple: (strategy names, ' < ' inherit role, inherited role, sequence number), these strategies are saved, just obtain with territory between the relevant access control policy of interoperability,
(2) local ontology generates automatically
The initial policy body that comprises access control policy element concept and the relationship of the concepts of take is basis, by with territory between the relevant access control policy of interoperability, cross-domain direct delegated strategy separately of two territories and the policy elements in cross-domain role's mapping policy are as the example of concept in initial policy body, join under the concept that initial policy body is corresponding, and add corresponding instance-of relation, forming respectively two territories local ontology separately, is also local body.Fig. 4 is the uml diagram of initial policy body.
(3) local ontology is carried out to Semantic mapping, the Semantic mapping generating between access control policy element example is the committed step in this algorithm to Semantic mapping, in order to narrate conveniently, making respectively two local ontology that above-mentioned steps obtains is local ontology A and local ontology B, corresponding domain A and territory B, concrete steps are as follows:
A), according to the structure of two local ontology, retrieve respectively role instance corresponding under " role " concept.
B), in role instance, inherit role's (because being in cross-domain role's mapping policy, so succession role is herein the foreign lands role in A territory) for one that retrieves in local ontology A; Meanwhile, in the role instance of local ontology B, retrieve its this territory role set (be being inherited role in role in the cross-domain direct delegated strategy of territory B and cross-domain role's mapping policy), be called role and gather S2.
C) consistency of being inherited the cross-domain direct delegated strategy at role place in the direct delegated strategy in this territory at role place and the S2 of local ontology B that the succession role in more local local A is corresponding, comprise the consistency that retrains element and authority element and relation thereof in the consistency, strategy of tactful number, if have inconsistently, get rid of this role.
D) by remaining role, relatively its degree of approximation value α of resource element and the degree of approximation value β between role in strategy of place separately.
E) the degree of approximation value weighted sum α * weight of two factors
α+ β * weight
β, draw total degree of approximation value, in S2, the role of respective value maximum is step b) in this role's of retrieving in local ontology A semantic equivalence role, two roles form Semantic mapping pair.
F) successively each in body A inherited to role and carries out b)-e) process, draw remaining Semantic mapping pair.
(4) overall body generates
According to the Semantic mapping of the policy elements example obtaining after Semantic mapping to (the actual Semantic mapping for role instance to), Semantic mapping centering two roles are added under role conception corresponding in initial policy body as an example, generate the common overall body in two territories.
(5) global access control strategy conversion, forms global access control strategy
According to the sign sequence number before access control policy element example, search in overall body the example of corresponding same sequence number under each concept, each example is combined, form global access control strategy, the sequence number in this global access control strategy tuple is made a living into the sequence number set of overall access control policy access control policy used.
3, policy conflict detection module
The implementation procedure of policy conflict detection module as shown in Figure 5.
(1) irrelevant strategy is removed
According to the access control policy attribute of an element in access control policy ordered set, be ' F (Foreign) ' or ' L (Local) ', access control policy ordered set is screened, remove with territory between the relevant access control policy of interoperability, be that attribute is the access control policy of ' F (Foreign) ', obtain the access control policy that attribute is ' L (Local) ', comprise the direct delegated strategy in this territory, this territory role succession strategy and user and assign strategy.
(2) implicit analysis of strategies
In conjunction with the direct delegated strategy in this territory filtering out, this territory role succession strategy, user assigns strategy, and the global access control strategy that obtains of multiple domain strategy integration module, according to the transfer of right relation between the role of this territory role succession strategy and the description of cross-domain role's mapping policy, analyze the authority that role or user have indirectly, imply authority, comprise user to the implicit authority of resource and role the implicit authority to resource, generate implicit access control policy, the implicit access control policy direct delegated strategy in this territory used will be drawn simultaneously, this territory role succession strategy, user assigns tactful sequence number set as the sequence number of implicit access control policy.
(3) policy map and conflict graph conversion
By the implicit access control policy obtaining, in conjunction with the direct delegated strategy in this territory, this territory role succession strategy, user, assign strategy and global access control strategy, extract user, role and resource wherein as the node of figure, using above-mentioned strategy as limit, forming strategies figure; Read conflict rule, by every conflict rule, extraction user, role and resource is wherein as the node of figure, limit using direct delegated strategy wherein between role node and resource node, limit using role succession strategy wherein between role node and role node, assigns the limit of strategy between user node and role node using user wherein, is converted to the form of figure, form conflict graph, in each conflict graph, comprise a paths;
The node of policy map and conflict graph, limit are provided as follows:
Node in figure divides for three classes: user, role, resource, with two tuple <type, value> represents, type has U, R, S, represent respectively user, role, resource, value represents concrete user name, role name or resource name.Limit in figure is divided three classes: the user that description user is assigned to role assigns the tactful limit (A represents by type) forming, the limit (T represents by type) of the role succession strategy formation of transfer of right between role is described, the limit (V represents by type) of the direct delegated strategy formation of role access resource is described, with six element group representation limit: <type, value, value, constraint, privilege, location>, type (type) has A, T, V tri-classes, two value are the value value of two nodes connecting of limit, constraint constraint is for allowing p (permit), refusal d (deny), authority privilege is for reading r (read), write w (write), carry out e (execute), when type is A, during T, this constraint field and privilege field are empty, only have when type is V, these two fields just have value.
(4) route searching with mate, detect and whether to have conflict, the type of conflicting and reason
According to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and every paths is mated with the path in each conflict graph, if the match is successful, there is conflict in explanation, according to the conflict graph type that the match is successful, draws the conflict type and the conflict reason that in policy map, clash, if mate unsuccessfully, directly generation does not exist the dialog box of conflict to be shown to user;
(5) reverse strategy is searched, and searches the source policy position at conflict place
After route matching success, according to the path in previous step and the conflict graph policy map that the match is successful, the sequence number of tackling according to access control policy in path, the strategy correspondence at this place, path at input policing file in reverse find policy map, be the strategy names in the B domain policy file described of the A domain policy file described of XACML and XACML, the conflict source policy position at place of this strategy names.
(6) generate conflict analysis report
The source policy position that whether has conflict, conflict type, conflict reason, conflict place drawing in step (4) (5) is generated to conflict analysis report, with the form of reporting, be shown to user.
Non-elaborated part of the present invention belongs to techniques well known.
The above is the preferred embodiment of the present invention; certainly can not limit with this interest field of the present invention; should be understood that; for those skilled in the art; under the premise without departing from the principles of the invention; can also make some improvement and change, these improvement and change are also considered as protection scope of the present invention.
Claims (4)
1. an access control policy collision detection system in cooperative surroundings, is characterized in that comprising: access control policy pretreatment module, multiple domain strategy integration module and policy conflict detection module;
Access control policy pretreatment module: by the strategy file in two territories that adopt XACML to describe, be that access control policy in the B domain policy file described of the A domain policy file described of XACML and XACML carries out grammatical and semantic parsing, when access control policy is resolved, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set, described access control policy ordered set is delivered to multiple domain strategy integration module; Described territory is the basic composition unit of cooperative surroundings, the tissue that the control strategy that independently conducts interviews in cooperative surroundings is formulated and managed; Described access control policy is the rule set of constraint main body to resource operation authority; Described main body is divided into user and role; Described resource comprises ftp server, web server, mail server and file server; Described operating right comprises reading and writing, execution and combination thereof; Described access control policy ordered set comprises role succession strategy, direct delegated strategy and user and assigns strategy; Described role succession strategy refers to the access control policy of the operating right of stipulating certain another role of role succession, form turns to five-tuple (strategy names, ' < ', role 1, role 2, sequence number), role 1 has inherited role 2 authority, the inheritance between ' < ' symbology role; Described role succession strategy is divided into again this territory role succession strategy and crosses over role's mapping policy, role 1 and role 2 in this territory role succession strategy belong to this territory, the role 1 who crosses in role's mapping policy belongs to another territory (being foreign lands), and role 2 belongs to this territory; Described direct delegated strategy refers to the access control policy of constraint role to resource operation authority, form turns to hexa-atomic group of (strategy names, constraint, role, resource, operating right, sequence number), constraint is divided into permission, refusal, other roles of Role including administrator role and system definition, resource comprises ftp server, web server, mail server and file server, and described operating right is divided into reading and writing, execution and combination thereof; Described direct delegated strategy is divided into again the direct delegated strategy in this territory and cross-domain direct delegated strategy, and role and resource in the direct delegated strategy in this territory all belong to this territory, and the role in cross-domain direct delegated strategy belongs to this territory, and resource belongs to foreign lands; Described user assigns strategy to refer to user is assigned to role, and has the access control policy of all authorities of role, and form turns to five-tuple (strategy names is assigned user, role, sequence number); Described strategy names refers to the title rising for strategy when policy development person generates strategy, and is the form of character string; Described role refers to the base unit that can directly have authority, is divided into other roles of administrator role or keeper's definition; Described user refers to the user of resource; Described appointment refers to the appointment relation between role-and-user, and the right assignment that soon role has, to user, makes user have the authority that role has; Described sequence number refers to tactful unique number;
Multiple domain strategy integration module: access control policy ordered set access control policy pretreatment module being obtained according to the access control policy element property in access control policy ordered set is screened, obtain with territory between the relevant access control policy of interoperability, and in conjunction with initial policy body, generate the local ontology in two territories, described local ontology is passed through to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to Semantic mapping to local ontology being converted to overall body, obtain global access control strategy, and global access control strategy is delivered to policy conflict detection module, described access control policy element property refers to that access control policy element is to belong to this territory L(Local) still belong to another one territory F(Foreign), described L is that this access control policy element of explanation belongs to this territory, described F illustrates that this access control policy element belongs to another territory, and just quote it in this territory, described initial policy body is two common bodies that territory is known in cooperative surroundings, described common body i.e. the clear and definite Formal Specification explanation to the shared access control policy model in two territories, only comprises the relationship of the concepts of access control policy element, described access control policy element comprises user, role, resource, reading and writing, execution, permission, refusal, inheritance, appointment relation, described access control policy element refers to the abstractdesription of described access control policy element, the concept instantiation of access control policy element has just been formed to the example of access control policy element, i.e. the specific descriptions to access control policy element, described local ontology refers to that the access control policy element example using in each territory is different, the access control policy element example that each territory is used is separately in conjunction with common body recited above, the body that has formed each territory oneself, i.e. local ontology, there is the local ontology of oneself in each territory, described overall body is that the access control policy element example that each territory is used is united, then in conjunction with described common body, has formed the total overall body in each territory, described global access control strategy refers to role succession strategy between the territory that does not have Semantic Heterogeneous problem,
Policy conflict detection module: the access control policy ordered set that access control policy preliminary treatment is obtained is screened, and the global access control strategy obtaining in conjunction with multiple domain strategy integration module, imply analysis of strategies, obtain access control policy implicit in cooperative surroundings, by access control policy ordered set, global access control strategy and implicit access control policy are converted to the form of policy map, conflict rule is converted to the form of conflict graph simultaneously, according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and described every paths is mated with the path in conflict graph, if the match is successful, there is conflict, and obtain conflict type and reason, by reverse strategy, inquire about, according to unique identification---the sequence number of the access control policy leading to a conflict, search the strategy names in input policing file of its correspondence, the conflict source policy position at place of this strategy names, and generate conflict analysis report and be shown to user, if mate unsuccessfully, there is not conflict, and show dialog box prompting user,
Described policy map full name is access control policy figure, soon user, role and the resource in access control policy is as the node of figure, limit using direct delegated strategy as role and between resource, limit using role succession strategy as role and between role, user is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as policy map; Described conflict rule is the form of IF-Then, and the former piece that IF statement is conflict rule has been described policy conflict the condition possessing is occurred, and the consequent that Then statement is conflict rule, has described the type of conflicting; Described conflict graph is the node using the user in the access control policy clashing, role and resource as figure, limit using the direct delegated strategy clashing between role and resource, limit using the role succession strategy clashing between role and role, the user who clashes is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as conflict graph.
2. access control policy collision detection system in cooperative surroundings according to claim 1, is characterized in that: described multiple domain strategy integration module implementation procedure is as follows:
(2.1) according to the access control policy attribute of an element in access control policy ordered set, be F or L, access control policy ordered set is screened, according to the access control policy element property in access control policy ordered set, be F or L, access control policy in access control policy ordered set is traveled through, when the access control policy element property traversing is F, the access control policy that this access control policy element place is described be with territory between the relevant access control policy of interoperability, these strategies are saved, just obtain with territory between the relevant access control policy of interoperability,
(2.2) take the initial policy body that comprises access control policy element concept and the relationship of the concepts as basis, the policy elements in the access control policy filtering out is added under the concept that initial policy body is corresponding, form respectively the local ontology in two territories;
(2.3) local ontology is carried out to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to the body construction of two local ontology, relation between instance name and access control policy element in body, calculate respectively in two local ontology degree of approximation value between corresponding role instance and the degree of approximation value between resource example, two degree of approximation values obtain total degree of approximation value after being weighted summation, two roles that degree of approximation value the greater is corresponding are the Semantic mapping pair between access control policy element example, two roles of Semantic mapping centering are added as an example under role conception corresponding in initial policy body simultaneously, obtain overall body,
(2.4) according to the sign sequence number before access control policy element example, search in overall body the example of corresponding same sequence number under each concept, each example is combined, form global access control strategy.
3. access control policy collision detection system in cooperative surroundings according to claim 1, is characterized in that: described policy conflict detection module implementation procedure is as follows:
(3.1) according to the access control policy attribute of an element in access control policy ordered set, be ' F(Foreign) ' or ' L(Local) ', access control policy ordered set is screened, remove with territory between the relevant access control policy of interoperability, be that attribute is the access control policy of ' F(Foreign) ', obtain the access control policy that attribute is ' L(Local) ', comprise the direct delegated strategy in this territory, this territory role succession strategy and user to assign strategy;
(3.2) in conjunction with the direct delegated strategy in this territory, this territory role succession strategy, the user that filter out, assign strategy, and the global access control strategy that obtains of multiple domain strategy integration module, according to the transfer of right relation between the role of this territory role succession strategy and the description of cross-domain role's mapping policy, analyze the authority that role or user have indirectly, implicit authority, obtains implicit access control policy;
(3.3) by the implicit access control policy obtaining, in conjunction with the direct delegated strategy in this territory, this territory role succession strategy, user, assign strategy and global access control strategy, extract user, role and resource wherein as the node of figure, using above-mentioned strategy as limit, forming strategies figure;
(3.4) read conflict rule, by every conflict rule, extraction user, role and resource is wherein as the node of figure, limit using direct delegated strategy wherein between role node and resource node, limit using role succession strategy wherein between role node and role node, assigns the limit of strategy between user node and role node using user wherein, is converted to the form of figure, form conflict graph, in each conflict graph, comprise a paths;
(3.5) according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and every paths is mated with the path in each conflict graph, if the match is successful, there is conflict in explanation, according to the conflict graph type that the match is successful, draws the conflict type and the conflict reason that in policy map, clash, if mate unsuccessfully, directly generation does not exist the dialog box of conflict to be shown to user;
(3.6) after route matching success, according to the strategy correspondence at this place, path in sequence number reverse find policy map at input policing file, it is the strategy names in the A domain policy file of XACML description and the B domain policy file of XACML description, the conflict source policy position at place of this strategy names, by the source policy position at the conflict place obtaining, together with the conflict type drawing in step (5) and conflict reason, generate conflict analysis report and be shown to user.
4. an access control policy collision detection method in cooperative surroundings, is characterized in that performing step is as follows:
(4.1) by the strategy file in two territories that adopt XACML to describe, be that access control policy in the B domain policy file described of the A domain policy file described of XACML and XACML carries out grammatical and semantic parsing, when access control policy is resolved, be that every access control policy adds sequence number, as the unique sign of described access control policy, after resolving, form access control policy ordered set, described access control policy ordered set is delivered to multiple domain strategy integration module; Described territory is the basic composition unit of cooperative surroundings, the tissue that the control strategy that independently conducts interviews in cooperative surroundings is formulated and managed; Described access control policy is the rule set of constraint main body to resource operation authority; Described main body is divided into user and role; Described resource comprises ftp server, web server, mail server and file server; Described operating right comprises reading and writing, execution and combination thereof; Described access control policy ordered set comprises role succession strategy, direct delegated strategy and user and assigns strategy; Described role succession strategy refers to the access control policy of the operating right of stipulating certain another role of role succession, form turns to five-tuple (strategy names, ' < ', role 1, role 2, sequence number), role 1 has inherited role 2 authority, the inheritance between ' < ' symbology role; Described role succession strategy is divided into again this territory role succession strategy and crosses over role's mapping policy, role 1 and role 2 in this territory role succession strategy belong to this territory, the role 1 who crosses in role's mapping policy belongs to another territory (being foreign lands), and role 2 belongs to this territory; Described direct delegated strategy refers to the access control policy of constraint role to resource operation authority, form turns to hexa-atomic group of (strategy names, constraint, role, resource, operating right, sequence number), constraint is divided into permission, refusal, other roles of Role including administrator role and system definition, resource comprises ftp server, web server, mail server and file server, and described operating right is divided into reading and writing, execution and combination thereof; Described direct delegated strategy is divided into again the direct delegated strategy in this territory and cross-domain direct delegated strategy, and role and resource in the direct delegated strategy in this territory all belong to this territory, and the role in cross-domain direct delegated strategy belongs to this territory, and resource belongs to foreign lands; Described user assigns strategy to refer to user is assigned to role, and has the access control policy of all authorities of role, and form turns to five-tuple (strategy names is assigned user, role, sequence number); Described strategy names refers to the title rising for strategy when policy development person generates strategy, and is the form of character string; Described role refers to the base unit that can directly have authority, is divided into other roles of administrator role or keeper's definition; Described user refers to the user of resource; Described appointment refers to the appointment relation between role-and-user, and the right assignment that soon role has, to user, makes user have the authority that role has; Described sequence number refers to tactful unique number;
(4.2) the access control policy ordered set according to the access control policy element property in access control policy ordered set, step (4.1) being obtained is screened, obtain with territory between the relevant access control policy of interoperability, and in conjunction with initial policy body, generate the local ontology in two territories, described local ontology is passed through to Semantic mapping, generate the Semantic mapping pair between access control policy element example, according to Semantic mapping, to local ontology being converted to overall body, obtain global access control strategy; Described access control policy element property refers to that access control policy element belongs to this territory L or belongs to another one territory F; Described L is that this access control policy element of explanation belongs to this territory; Described F illustrates that this access control policy element belongs to another territory, and just quote it in this territory; Described initial policy body is two common bodies that territory is known in cooperative surroundings; Described common body i.e. the clear and definite Formal Specification explanation to the shared access control policy model in two territories, only comprises the relationship of the concepts of access control policy element; Described access control policy element comprises user, role, resource, reading and writing, execution, permission, refusal, inheritance, appointment relation; Described access control policy element refers to the abstractdesription of described access control policy element, the concept instantiation of access control policy element has just been formed to the example of access control policy element, i.e. the specific descriptions to access control policy element; Described local ontology refers to that the access control policy element example using in each territory is different, the access control policy element example that each territory is used is separately in conjunction with common body recited above, the body that has formed each territory oneself, i.e. local ontology, there is the local ontology of oneself in each territory; Described overall body is that the access control policy element example that each territory is used is united, then in conjunction with described common body, has formed the total overall body in each territory; Described global access control strategy refers to role succession strategy between the territory that does not have Semantic Heterogeneous problem;
(4.3) access control policy ordered set step (4.1) being obtained is screened, and the global access control strategy that obtains of integrating step (4.2), imply analysis of strategies, obtain access control policy implicit in cooperative surroundings, by access control policy ordered set, global access control strategy and implicit access control policy are converted to the form of policy map, conflict rule is converted to the form of conflict graph simultaneously, according to the relation between the limit being connected by node in policy map and limit, obtain in policy map by set out every paths of resource node of role node, and described every paths is mated with the path in conflict graph, if the match is successful, there is conflict, and obtain conflict type and reason, by reverse strategy, inquire about, according to the unique identification-sequence number of the access control policy leading to a conflict, search the strategy names in input policing file of its correspondence, the conflict source policy position at place of this strategy names, and generate conflict analysis report and be shown to user, if mate unsuccessfully, there is not conflict, and show dialog box prompting user,
Described policy map full name is access control policy figure, soon user, role and the resource in access control policy is as the node of figure, limit using direct delegated strategy as role and between resource, limit using role succession strategy as role and between role, user is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as policy map; Described conflict rule is the form of IF-Then, and the former piece that IF statement is conflict rule has been described policy conflict the condition possessing is occurred, and the consequent that Then statement is conflict rule, has described the type of conflicting; Described conflict graph is the node using the user in the access control policy clashing, role and resource as figure, limit using the direct delegated strategy clashing between role and resource, limit using the role succession strategy clashing between role and role, the user who clashes is assigned to the limit of strategy between user and role, and the figure forming is thus referred to as conflict graph.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110322928.8A CN102387145B (en) | 2011-10-21 | 2011-10-21 | System and method for detecting access control strategy collision in collaborative environment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110322928.8A CN102387145B (en) | 2011-10-21 | 2011-10-21 | System and method for detecting access control strategy collision in collaborative environment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102387145A CN102387145A (en) | 2012-03-21 |
| CN102387145B true CN102387145B (en) | 2014-03-12 |
Family
ID=45826119
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110322928.8A Expired - Fee Related CN102387145B (en) | 2011-10-21 | 2011-10-21 | System and method for detecting access control strategy collision in collaborative environment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102387145B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103049700B (en) * | 2013-01-28 | 2015-03-25 | 北京航空航天大学 | Conflict detection system and method for computer network defense (CND) policy |
| CN103095716B (en) * | 2013-01-28 | 2015-09-02 | 北京航空航天大学 | Computer network defense decision system |
| CN103198361B (en) * | 2013-03-09 | 2016-04-13 | 西安电子科技大学 | Based on the XACML strategy evaluation engine system of multiple Optimization Mechanism |
| CN106960136B (en) * | 2016-01-08 | 2020-07-24 | 阿里巴巴集团控股有限公司 | Subscription conflict detection method and device |
| CN110569667B (en) * | 2019-09-10 | 2022-03-15 | 北京字节跳动网络技术有限公司 | Access control method and device, computer equipment and storage medium |
| CN110955903B (en) * | 2019-11-22 | 2021-03-30 | 支付宝(杭州)信息技术有限公司 | Privacy resource authority control method, device and equipment based on intelligent graph calculation |
| CN111756691B (en) * | 2020-05-19 | 2021-10-08 | 中国科学院信息工程研究所 | Acquisition strategy conflict detection method and device, electronic equipment and storage medium |
| CN113836500B (en) * | 2020-06-23 | 2023-11-07 | 上海森亿医疗科技有限公司 | Data authority control method, system, terminal and storage medium |
| CN113221138B (en) * | 2021-04-30 | 2022-11-18 | 中核武汉核电运行技术股份有限公司 | Authority management system |
| CN114003963B (en) * | 2021-12-30 | 2022-05-06 | 天津联想协同科技有限公司 | Method, system, network disk and storage medium for file authorization under enterprise network disk |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945446A (en) * | 2009-07-10 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system for processing strategy conflict by user equipment |
| CN101951384A (en) * | 2010-09-29 | 2011-01-19 | 南京信息工程大学 | Distributed security domain logic boundary protection method |
| CN102014159A (en) * | 2010-11-29 | 2011-04-13 | 华中科技大学 | Layered resource reservation system under cloud computing environment |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080295145A1 (en) * | 2007-05-23 | 2008-11-27 | Motorola, Inc. | Identifying non-orthogonal roles in a role based access control system |
| US7864676B2 (en) * | 2008-07-14 | 2011-01-04 | The Mitre Corporation | Network cross-domain precedence and service quality conflict mitigation |
-
2011
- 2011-10-21 CN CN201110322928.8A patent/CN102387145B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945446A (en) * | 2009-07-10 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system for processing strategy conflict by user equipment |
| CN101951384A (en) * | 2010-09-29 | 2011-01-19 | 南京信息工程大学 | Distributed security domain logic boundary protection method |
| CN102014159A (en) * | 2010-11-29 | 2011-04-13 | 华中科技大学 | Layered resource reservation system under cloud computing environment |
Non-Patent Citations (2)
| Title |
|---|
| 《Conflict Detection Model of Access Control Policy in Collaborative Environment》;Beibei Fan等;《2011 International Conference on Computational and Information Sciences》;20111023;全文 * |
| Beibei Fan等.《Conflict Detection Model of Access Control Policy in Collaborative Environment》.《2011 International Conference on Computational and Information Sciences》.2011,全文. |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102387145A (en) | 2012-03-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102387145B (en) | System and method for detecting access control strategy collision in collaborative environment | |
| US11140166B2 (en) | Multi-tenant authorization | |
| US10977380B2 (en) | Hybrid role and attribute based access control system | |
| Rao et al. | Towards defining dimensions of knowledge systems quality | |
| CN103745161B (en) | Access method of controlling security and device | |
| US20190364051A1 (en) | Organization based access control system | |
| CN101339591A (en) | XACML policy rule checking method | |
| Kagal et al. | Preserving privacy based on semantic policy tools | |
| Collinson et al. | Layered graph logic as an assertion language for access control policy models | |
| Haddad et al. | Access control for data integration in presence of data dependencies | |
| Kirrane | Linked data with access control | |
| Hu et al. | A semantic privacy-preserving model for data sharing and integration | |
| Acosta et al. | HARE: A hybrid SPARQL engine to enhance query answers via crowdsourcing | |
| KR101027667B1 (en) | Context Aware - Access Control Management System, Management Method Thereof and The Recorder | |
| Sadeghi et al. | A semantic-based access control mechanism for distributed systems | |
| Bellini et al. | Rights enforcement and licensing understanding for RDF stores aggregating open and private data sets | |
| Nabil et al. | ABAC conceptual graph model for composite web services | |
| Sun et al. | Specification and enforcement of flexible security policy for active cooperation | |
| Coupette et al. | Legal hypergraphs | |
| Liu et al. | Implement Security Analysis of Access Control Policy Based on Constraint by SMT | |
| Szárnyas | Query, analysis, and benchmarking techniques for evolving property graphs of software systems | |
| Hu et al. | Semantics-enabled policies for information sharing and protection in the cloud | |
| Hu et al. | Crafting a balance between big data utility and protection in the semantic data cloud | |
| Kim et al. | RBAC-based access control for privacy preserving in semantic web | |
| Ravari et al. | A semantic aware access control model with real time constraints on history of accesses |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20140312 Termination date: 20181021 |