Universal distributed access control decision middleware

Computer Engineering and Applications ›› 2008, Vol. 44 ›› Issue (1): 17-20.

• 博士论坛 • Previous Articles Next Articles

Universal distributed access control decision middleware

ZHAI Zheng-de,FENG Deng-guo

State Key Laboratory of Information Security，Institute of Software，Chinese Academy of Sciences，Beijing 100080，China

Received:1900-01-01 Revised:1900-01-01 Online:2008-01-01 Published:2008-01-01
Contact: ZHAI Zheng-de

一个通用的分布式访问控制决策中间件

翟征德,冯登国

中国科学院软件研究所信息安全国家重点实验室，北京 100080

通讯作者: 翟征德

Abstract

Abstract: To separate security functions from applications and reconstruct them into universal and standard services can help simplify the development of applications and make the security functions reusable.In the paper，a Universal Distributed Access Control Decision（UDACD） middleware which employs XACML is designed and implemented.It encapsulates the details of access decision and provides universal decision services to various kinds of distributed applications.UDACD can enforce multiple kinds of policies at the same time and support cross-domain anonymous resource access control.It employs policy cache and two levels of attribute caches，which can remarkably accelerate decision speed.It can help simplify policy administration and provide consistent policy enforcement among multiple applications.

Key words: access control, access control decision, cross-domain access control, XACML

摘要： 将各种安全功能从上层应用中抽象出来形成一种通用和标准的安全服务，可以简化应用开发的复杂性和增强安全功能的可重用性。论文设计并实现了一个基于XACML的通用分布式访问控制决策中间件UDACD（Universal Distributed Access Control Decision），对分布式环境下的访问控制决策过程进行了封装，对外面向各种应用提供通用的决策服务。UDACD支持多种访问控制策略类型和跨管理域的匿名资源访问控制；实现了对策略的缓存和对用户安全属性的两级缓存，显著加快了决策速度。UDACD可以帮助简化策略管理，并提供跨应用的一致策略实施。

关键词: 访问控制, 访问控制决策, 跨域访问控制, XACML

ZHAI Zheng-de,FENG Deng-guo. Universal distributed access control decision middleware[J]. Computer Engineering and Applications, 2008, 44(1): 17-20.

翟征德,冯登国. 一个通用的分布式访问控制决策中间件[J]. 计算机工程与应用, 2008, 44(1): 17-20.

[1]	YU Bo, TAI Xianqing, MA Zhijie. Study on Attribute and Trust-Based RBAC Model in Cloud Computing [J]. Computer Engineering and Applications, 2020, 56(9): 84-92.
[2]	WU Bo, LIU Yi. Data Deduplication Scheme with Dynamic Ownership Management Based on RCE in Cloud Storage [J]. Computer Engineering and Applications, 2020, 56(5): 101-108.
[3]	Gulmire ARKEN, Nurmamat HELIL. CP-ABE Re-encryption Based Access Control Constraint for Sensitive Data [J]. Computer Engineering and Applications, 2020, 56(18): 69-76.
[4]	ZHENG Zupeng, WANG Zumin, PENG Yang, JI Changqing, QIN Jing. Survey of MAC Protocols for Energy Harvesting Sensor Networks [J]. Computer Engineering and Applications, 2020, 56(15): 24-29.
[5]	YIN Longxiao, WU Zhongdong. Revocation Control Scheme in CP-ABE [J]. Computer Engineering and Applications, 2020, 56(13): 100-105.
[6]	WANG Jingyu, LUAN Junqing, TAN Yuesheng. Research on Big Data Access Control Model Based on Data Sensitivity [J]. Computer Engineering and Applications, 2019, 55(23): 70-77.
[7]	CHEN Lu, WANG Ze. Access Control Scheme Based on ATP-ABE [J]. Computer Engineering and Applications, 2019, 55(2): 79-85.
[8]	TAN Yuesheng, LU Liming, WANG Jingyu. Ciphertext-Policy Attribute Encryption Scheme Based on Homomorphic Encryption [J]. Computer Engineering and Applications, 2019, 55(19): 115-120.
[9]	WANG Siyu, HE Jingsha, TENG Da. Access Control System Supporting Quantification and Protection of Privacy Information [J]. Computer Engineering and Applications, 2019, 55(16): 77-87.
[10]	XU Guoyu, MIAO Xuna, ZHANG Junfeng, JIANG Tao, MA Xiaofei. Review of implicit authentication for mobile devices [J]. Computer Engineering and Applications, 2018, 54(6): 19-25.
[11]	PENG Fei1, ZHANG Tao1, XU Weiguang1, ZHAO Min1, QIN Hengjia2. Security policy generation model of operating system based on ontology [J]. Computer Engineering and Applications, 2018, 54(2): 114-118.
[12]	TAN Yuesheng, NING Ning, WANG Jingyu. Research of cloud data access control based on Purpose-Based Access Control and Attribute-Based Encryption [J]. Computer Engineering and Applications, 2018, 54(13): 117-122.
[13]	XIA Zhijian, PENG Guojun, HU Hongfu. Detection of access control vulnerabilities in Web applications based on privilege verification graph [J]. Computer Engineering and Applications, 2018, 54(12): 63-68.
[14]	GUO Jing, WANG Xuecheng, YUAN Chunping. Survey on MAC layer rate control mechanisms [J]. Computer Engineering and Applications, 2017, 53(6): 7-13.
[15]	ZHANG Sai, YANG Geng, HAN Yamei, TU Yuanfei. Attribute-based hierarchical access control with hidden policy supporting attribute revocation [J]. Computer Engineering and Applications, 2017, 53(4): 51-58.

Universal distributed access control decision middleware

一个通用的分布式访问控制决策中间件

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics