English Abstract: Access control is an important supporting technique for information security, which provides confidentiality and integrity protection for resources. As a new and promising technique, ABAC performs authorization decision according to the attributes of the users', resources' and environments'. ABAC provides fine authorization granularity and flexible attribute framework, which enables it to describe multiple policy types. As a typical example of ABAC, RBAC can significantly decrease the cost of security administration and has achieved wide usage. Centering on ABAC and RBAC (as a special case of ABAC), the paper focuses on ABAC model、framework of realization、delegation based authorization management and cross-domain authorization applications and has obtained the following achievements: A Flexible Attribute Based Access Control model (F-ABAC) is proposed. A flexible attribute framework is provided, which can accurately describe multiple policy types. A flexible policy combining method is presented, which enables the administrators to accurately define the ways resources are protected. F-ABAC can be used to enforce multiple access control policies simultaneously. ABAC based authorization management through delegation is researched. RBAC taken as an example, a formal Quantified-role Based Controllable Delegation Model (QBCDM) is proposed. The concept of quantified-role is introduced, which provides flexible delegation granularity, while avoiding incurring high administrative cost. A fine-grained delegation constraint mechanism with both mandatory and discretionary characteristics is presented, which ensures the constringency of users' delegation ability in multi-step delegations. Then ideas and realization mechanisms of QBCDM is generalized to ABAC delegation. ABAC based cross-domain authorization is researched. As to trust management, RBAC taken as an example, a Fine-grained Controllable Delegation Authorization Model (FCDAM) suitable for large-scale open environments is proposed, in which trustworthiness is used to achieve propagation control of permissions of different sensitivity level in role. Then the ideas and realization mechanisms of FCDAM is generalized to delegation authorization model based on ABAC policy, which provides an effective authorization technique for constructing virtual computation environments on Internet. As to cross-domain secure interoperation, a method of detecting and avoiding violation of Static Mutual Exclusive Roles (SMER) constraints is presented. The reason and the necessary and sufficient conditions for SMER constraint violations are analyzed and proposed. The prerequisite conditions for adding new role associations and user/role assignments are given, which can ensure that SMER constraints are always abided by. The conclusions are also generalized to ABAC secure interoperation. A Universal Access Control Decision (UACD) middleware, which enforces ABAC, employing SAML and XACML, is designed and implemented. Anonymous cross-domain authorization decision is supported.UACD can help simplify the development of applications and enhance the reusability of access decision functions. It lays the foundation for ABAC's usage in reality. In summary, from the perspectives of authorization model, delegation and cross-domain authorization, the theoretical achievements of the thesis promote both the research of ABAC and that of RBAC. The ABAC middleware architecture proposed lays a technical foundation for ABAC usage in reality.
翟征德. 基于属性的访问控制模型与应用研究[D]. 软件研究所. 中国科学院软件研究所. 2008-01-14.