提出一种扩展的基于角色的访问控制ERBAC模型，以解决RBAC在多域云系统的资源使用约束、策略管理和互操作安全性等方面存在的不足。首先，通过引入容器元素和两类角色基数约束，构建了基于容器元素+动态角色基数约束的资源使用策略；其次，深入研究了多域角色继承管理，提出基于先检测后建立角色关系的域间策略管理函数，并给出各类安全策略冲突检测算法。分析表明，ERBAC模型实现了资源使用约束、支持高效的安全策略管理，提高了跨域互操作的安全性，且性能测试说明了该模型在多域云系统中具有适应性和可行性。

We propose an enhanced role-based access control (ERBAC) model to solve the shortcomings of the RBAC’s resource usage constraints, policy management and interoperability security in multi-domain cloud systems. Firstly, we introduce elements of containers and two role cardinality constraints into the RBAC, and establish the containers + dynamic role cardinality constraints based resource usage policy. Secondly, we study the role inheritance management for multi-domains in depth and present an inter-domain policy management function, whose objective is to check for the number of violations before committing an inter-domain role inheritance relation. Then, various security detection algorithms for policy conflict are given. Analysis results show that the ERBAC model can improve the security of inter-domain interoperation, enforce usage constraints upon resources and manage the security policies in an easy and effective way, which proves to be feasible and applicable for multi-domain cloud systems.
相关文章

[1]	李真，岳厚光，陈才贤. PLM系统中访问控制的研究与实现[J]. J4, 2010, 32(4): 39-41.
[2]	冯学斌[1] 郑峰[2] 洪帆[1]. IRBAC 2000角色转换冲突处理策略[J]. J4, 2007, 29(9): 53-55.
[3]	林晨 李之棠. VPN系统中安全策略系统的设计与实现[J]. J4, 2007, 29(6): 21-23.
[4]	隋品波 史殿习 王玉峰. 可移植对象适配器策略机制的分析与设计[J]. J4, 2006, 28(8): 134-139.
[5]	蒋江 张民选 等. 一种基于多种资源的负载平衡算法的设计与模拟[J]. J4, 2002, 24(6): 71-74.