使用XACML的活动依赖策略的规范与实施
Specification and Enforcement of Activity Dependency Policies using XACML
AI总结：
提出基于XACML扩展的XACML_AD框架，用于规范活动依赖策略，支持依赖评估与持续实施，确保活动生命周期内的安全控制。
摘要：
不断发展的智能互联系统旨在以最少的人工干预运行。这些智能系统中的设备通常基于传感器数据和上下文因素进行长时间操作。最近，一种以活动为中心的访问控制（ACAC）模型被引入，用于规范这些长时间操作（称为活动），这些活动在较长时间内经历状态变化。不同活动之间的依赖关系可以相互影响并限制彼此的执行，因此需要对活动之间的依赖关系进行主动和实时的监控，以防止安全违规。在ACAC模型中，活动依赖关系（表示为“D”）被视为控制请求活动的决策参数。这些依赖关系必须在活动生命周期的所有阶段进行评估。\n\n为了确保跨不同领域和应用的访问控制规则的一致性，标准策略语言至关重要。我们提出了一种策略框架，采用广泛使用的可扩展访问控制标记语言（XACML），称为XACML_AD，用于规范活动依赖策略。这项工作涉及通过引入新元素来扩展XACML的语法和语义，以检查依赖活动的状态并处理依赖活动的状态更新。除了语言扩展外，我们还提出了评估活动依赖策略的实施架构和数据流模型。所提出的XACML_AD策略框架与策略实施的集成支持依赖评估、必要的更新和策略的持续实施，以控制活动在其整个生命周期中的执行。我们实现了利用XACML_AD策略框架的实施架构，并讨论了性能评估结果。
英文摘要：
The evolving smart and interconnected systems are designed to operate with minimal human intervention. Devices within these smart systems often engage in prolonged operations based on sensor data and contextual factors. Recently, an Activity-Centric Access Control (ACAC) model has been introduced to regulate these prolonged operations, referred to as activities, which undergo state changes over extended duration of time. Dependencies among different activities can influence and restrict the execution of one another, necessitating active and real-time monitoring of the dependencies between activities to prevent security violation. In the ACAC model, the activity dependencies, denoted as "D", is considered as a decision parameter for controlling a requested activity. These dependencies must be evaluated throughout all phases of an activity's life cycle. To ensure the consistency of access control rules across diverse domains and applications, a standard policy language is essential. We propose a policy framework adapting the widely-used eXtensible Access Control Markup Language (XACML) , referred to as $\mathrm{XACML_{AD}}$, to specify the activity dependency policies. This work involves extending the syntax and semantics of XACML by introducing new elements to check dependent activities' states and handle state updates on dependent activities. In addition to the language extension, we present the enforcement architecture and data flow model of evaluating policies for activity dependencies. The integration of the proposed $\mathrm{XACML_{AD}}$ policy framework and the enforcement of the policies supports dependency evaluation, necessary updates and continuous enforcement of policies to control an activity throughout its life cycle. We implement the enforcement architecture exploiting the $\mathrm{XACML_{AD}}$ policy framework and discuss the performance evaluation results.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
