Web服务基于代理和角色的访问控制模型研究

在Web服务中，由于传统的基于角色的访问控制模型（RBAC）无法灵活地实现基于内容和上下文的访问控制策略，从而无法适应Web服务代理动态、临时性的特点，也不能满足Web服务内容和上下文敏感的要求。因此,本文提出了一种基于代理和角色的访问控制模型（ARBAC）。本模型中，Web服务代理访问控制器根据用户及代理权限生成代理实体来取代用户访问主体的角色。代理实体是用户授权的临时的虚拟实体，它的权限是由用户和代
理两者的访问权限决定的。理论上，它的生命周期是在一次访问请求范围内。

A Role-and Agent-Based Access Control Model in Web Services

In Web services, the traditional role-based access control model cannot implement content-based and contextbased access control policies flexibly, h cannot meet the demands of Web Services agent＇s dynamic and temporary features and Web services＇ context and content sensitivity. We propose a role-and agent-based access control model （ARBAC）. In the ARBAC model, the access controoller of the Web services＇ agent will produce an agent entity which is used to replace the user（subject）. The agent entity is a temporary and fictitious subject whose permission is limited  by the permission of the user and whose life cycle is within one requisition.