基于角色授权的Web service访问控制模型

访问控制是一种实现信息安全的有效措施,可防止对资源的未授权访问.针对目前Web服务本身的安全控制不能很好地适应企业级用户的安全需求这一问题,构造了一种基于角色授权的Web服务访问控制模型.该模型将权限同角色联系起来,根据服务特征及访问状态给用户赋予不同的角色,用户通过得到的相应角色获得访问权限,从而实现对服务本身的保护,防止未授权用户获取 服务信息.另外文中还讨论了该模型实现中的几个关键问题.     

RBAC优化模型在嵌入式Web系统中的应用研究

针对嵌入式Web应用系统的自身安全,结合嵌入式Web应用系统的自身特点,通过分析现有基于角色的访问控制模型的不足,提出了一种改进的RBAC模型。通过引入用户组和部门概念,对RBAC模型进行了重新描述和形式化定义。通过优化,将用户实体之间的关系理顺,利用对用户分组,更进一步降低授权管理的复杂度,减少授权管理中的失误,使其能够更加符合实际应用中的需求。同时,在此访问控制模型的基础上,实现嵌入式Web应用系统的访问控制功能,并对实现的Web应用系统进行测试,以验证访问控制方案的性能。     

利用RBAC机制实现WWW环境中的安全访问控制

提出了一种基于WWW的扩展RBAC模型，在用户和角色之间增加角色代理层，由客户端完成代理角色的功能，实现角色的动态分配和解决网络传输瓶颈问题，克服了标准的基于角色的访问控制模型应用于WWW环境的缺陷，并探讨了以这种扩展RBAC模型为基础的互联网环境下的安全访问控制的实现，这种安全访问控制方案能较好地适用于基于Web的应用系统。     

基于命令模式的权限控制的设计与实现

针对Web系统的特点及其对用户访问控制的特殊要求,笔者在RBAC（基于角色的访问控制）模型的基础上引入了命令模式,设计并实现了分级的、细粒度的权限管理子系统.基于设计模式中的命令模式,利用方法调用与方法执行分离的原则和采用集中调度控制所有方法执行的方式,设计出一种灵活的权限控制管理.实践证明此方案不仅可以满足大中型Web系统对权限管理的需求,而且能随组织结构或安全需求的变化而变化,具有很好的灵活性和可操作性.     

B/S系统的用户权限设计与实现

针对B／S系统中的用户权限访问控制的问题，提出了一种基于角色访问控制和Web Services技术的用户权限设计。利用角色访问控制技术可以有效地实现用户访问权限的动态管理，而Web Services提供的高度互操作性和访问性能够很好地完成对用户权限的验证。在某油田无线数据管理信息系统中，将两者结合起来，取得了较好的效果。     

Ajax技术在Web Services应用中的安全研究

分析了Ajax技术的工作原理，讨论了其在Web Services应用中存在的安全问题，给出了用户服务请求．中包含的敏感信息的保护方案，重点介绍了一种在Ajax技术下的Web Services的访问控制策略，充分利用了基于角色的访问控制策略，并对其做了扩展，提出了基于逻辑的访问控制策略。     

基于安全性规范与RBAC模型的Web Service安全框架研究

基于WS-Security规范和基于角色的访问控制模型提出一种灵活、可扩展的Web服务安全通信框架WsSF,并选择基于角色的访问控制模型RBAC作为Web Service访问控制的基础模型,建立了基于Web服务的RBAC模型,可为Web Service安全实践提供参考。     

基于Web Service的访问控制供应的研究

针对目前多个应用系统对共享的访问控制系统的需求,结合Web Service服务环境特点及关注点分离思想,提出一种基于Web Service的访问控制供应结构,给出访问控制供应服务订阅,访问控制判定实现过程,解决了各领域重复开发访问控制系统及访问控制供应的问题,实现应用系统与访问控制供应的柔性连接。     

Web服务中的基于快速信任的访问控制模型

OASIS的WEB服务安全规范，不提供信任评估和授权决策的支持。文中针对于Web服务下，虚拟临时组织中的访问控制和授权，设计了一种基于怏速信任的访问控制模型（WS—STBAC，SwiftTrust—Based Access Control for Web Service），一种与认证中心相类似的中间件。WS—STBAC南策略管理、信任度计算和授权决策3个模块组成。在获得提供方的访问控制策略和信任计算所需的数据和算法之后，WS—STBAC计算对请求方的信任度。并根据访问控制策略，代替服务提供方进行授权决策。     

利用属性证书实现Web资源的角色访问控制

针对目前Web资源访问控制过程中存在的问题，提出了利用属性证书实现Web的角色访问控制方法。同时通过用户、角色和权限之间的关系，给出了属性证书的应用方案，详细分析了其实现过程、属性证书的验证过程和用户角色的层次关系，最后分析总结了利用属性证书实现基于角色的访问控制的应用特点。     

Characterization of Ordovician carbonate reservoirs, southeastern Saskatchewan, Canada

The discovery of the prolific Ordovician Red River reservoirs in 1995 in southeastern Saskatchewan was the catalyst for extensive exploration activity which resulted in the discovery of more than 15 new Red River pools. The best yields of Red River production to date have been from dolomite reservoirs. Understanding the processes of dolomitization is, therefore, crucial for the prediction of the connectivity, spatial distribution and heterogeneity of dolomite reservoirs.The Red River reservoirs in the Midale area consist of 3～4 thin dolomitized zones, with a total thickness of about 20 m, which occur at the top of the Yeoman Formation. Two types of replacement dolomite were recognized in the Red River reservoir: dolomitized burrow infills and dolomitized host matrix. The spatial distribution of dolomite suggests that burrowing organisms played an important role in facilitating the fluid flow in the backfilled sediments. This resulted in penecontemporaneous dolomitization of burrow infills by normal seawater. The dolomite in the host matrix is interpreted as having occurred at shallow burial by evaporitic seawater during precipitation of Lake Almar anhydrite that immediately overlies the Yeoman Formation. However, the low δ18O values of dolomited burrow infills (-5.9‰～ -7.8‰, PDB) and matrix dolomites (-6.6‰～ -8.1‰, avg. -7.4‰ PDB) compared to the estimated values for the late Ordovician marine dolomite could be attributed to modification and alteration of dolomite at higher temperatures during deeper burial, which could also be responsible for its 87Sr/86Sr ratios (0.7084～0.7088) that are higher than suggested for the late Ordovician seawaters (0.7078～0.7080). The trace amounts of saddle dolomite cement in the Red River carbonates are probably related to "cannibalization" of earlier replacement dolomite during the chemical compaction.     

A computer generator for randomly layered structures

AcomputergeneratorforrandomlylayeredstructuresYUJia shun1,2,HEZhen hua2(1.TheInstituteofGeologicalandNuclearSciences,NewZealand;2.StateKeyLaboratoryofOilandGasReservoirGeologyandExploitation,ChengduUniversityofTechnology,China)Abstract:Analgorithmisintrod…     

海南岛地体及其毗邻陆缘晚中生代—新生代古地磁研究和构造演化

本文叙述了对海南岛及其毗邻大陆边缘白垩纪到第四纪地层岩石进行古地磁研究的全部工作过程。通过分析岩石中剩余磁矢量的磁偏角及磁倾角的变化,提出海南岛白垩纪以来经历的构造演化模式如下:早期伴随顺时针旋转而向南迁移,后期伴随逆时针转动并向北运移。联系该地区及邻区的地质、地球物理资料,对海南岛上述的构造地体运动提出以下认识:北部湾内早期有一拉张作用,主要是该作用使湾内地壳显著伸长减薄,形成北部湾盆地。从而导致了海南岛的早期构造运动,而海南岛后期的构造运动则主要是受南海海底扩张的影响。海南地体运动规律的阐明对于了解北部湾油气盆地的形成演化有重要的理论和实际意义。     

Exciton Seebeck in Molecular Systems

Various applications relevant to the exciton dynamics,such as the organic solar cell,the large-area organic light-emitting diodes and the thermoelectricity,are operating under temperature gradient.The potential abnormal behavior of the exicton dynamics driven by the temperature difference may affect the efficiency and performance of the corresponding devices.In the above situations,the exciton dynamics under temperature difference is mixed with     

Achieving Unusual States of Matter Under High Pressure

The elongation method,originally proposed by Imamura was further developed for many years in our group.As a method towards O(N)with high efficiency and high accuracy for any dimensional systems.This treatment designed for one-dimensional(ID)polymers is now available for three-dimensional(3D)systems,but geometry optimization is now possible only for 1D-systems.As an approach toward post-Hartree-Fock,it was also extended to     

《Chinese Science Bulletin》SUBJECT INDEX TO VOLUME 59(2014)

正~~     

An on-line scaling method for improving scalability of a database cluster

The explosive growth of the Internet and database applications has driven database to be more scalable and available, and able to support on-line scaling without interrupting service. To support more client's queries without downtime and degrading the response time, more nodes have to be scaled up while the database is running. This paper presents the overview of scalable and available database that satisfies the above characteristics. And we propose a novel on-line scaling method. Our method improves the existing on-line scaling method for fast response time and higher throughputs. Our proposed method reduces unnecessary network use, i.e. , we decrease the number of data copy by reusing the backup data. Also, our on-line scaling operation can be processed parallel by selecting adequate nodes as new node. Our performance study shows that our method results in significant reduction in data copy time.     

An improved R-tree based on childnode''s probability

R-Tree is a good structure for spatial searching. But in this indexing structure,either the sequence of nodes in the same level or sequence of traveling these nodes when queries are made is random. Since the possibility that the object appears in different MBR which have the same parents node is different, if we make the subnode who has the most possibility be traveled first, the time cost will be decreased in most of the cases. In some case, the possibility of a point belong to a rectangle will shows direct proportion with the size of the rectangle. But this conclusion is based on an assumption that the objects are symmetrically distributing in the area and this assumption is not always coming into existence. Now we found a more direct parameter to scale the possibility and made a little change on the structure of R-tree, to increase the possibility of founding the satisfying answer in the front sub trees. We names this structure probability based arranged R-tree (PBAR-tree).     

An Index mechanism for multi-scale view in spatial databases

There are numerous geometric objects stored in the spatial databases. An importance function in a spatial database is that users can browse the geometric objects as a map efficiently. Thus the spatial database should display the geometric objects users concern about swiftly onto the display window. This process includes two operations:retrieve data from database and then draw them onto screen. Accordingly, to improve the efficiency, we should try to reduce time of both retrieving object and displaying them. The former can be achieved with the aid of spatial index such as R-tree, the latter require to simplify the objects. Simplification means that objects are shown with sufficient but not with unnecessary detail which depend on the scale of browse. So the major problem is how to retrieve data at different detail level efficiently. This paper introduces the implementation of a multi-scale index in the spatial database SISP (Spatial Information Shared Platform) which is generalized from R-tree. The difference between the generalization and the R-tree lies on two facets: One is that every node and geometric object in the generalization is assigned with a importance value which denote the importance of them, and every vertex in the objects are assigned with a importance value,too. The importance value can be use to decide which data should be retrieve from disk in a query. The other difference is that geometric objects in the generalization are divided into one or more sub-blocks, and vertexes are total ordered by their importance value. With the help of the generalized R-tree, one can easily retrieve data at different detail levels.Some experiments are performed on real-life data to evaluate the performance of solutions that separately use normal spatial index and multi-scale spatial index. The results show that the solution using multi-scale index in SISP is satisfying.     

Integrating GIS Web services based on mediating architecture

The geographic information service is enabled by the advancements in general Web service technology and the focused efforts of the OGC in defining XML-based Web GIS service. Based on these models, this paper addresses the issue of services chaining,the process of combining or pipelining results from several interoperable GIS Web Services to create a customized solution. This paper presents a mediated chaining architecture in which a specific service takes responsibility for performing the process that describes a service chain. We designed the Spatial Information Process Language (SIPL) for dynamic modeling and describing the service chain, also a prototype of the Spatial Information Process Execution Engine (SIPEE) is implemented for executing processes written in SIPL. Discussion of measures to improve the functionality and performance of such system will be included.