基于屬性的訪問控制（ABAC）是面向Web Service應(yīng)用的一種新的訪問控制方法。可
擴(kuò)展訪問控制標(biāo)記語言XACML是一種支持該方法的重要規(guī)范，它給出了ABAC策略執(zhí)行框架以及ABAC 策略的定義語言。但XACML 中策略定義非常繁瑣復(fù)雜，對用戶提出了很高要求。本文在對ABAC模型進(jìn)行分析研究的基礎(chǔ)上，分析了XACML的策略定義語言，提出了基于XACML 的ABAC策略模版，并給出了基于策略模版編寫ABAC 策略的方法，從而在保證策略正確定義的基礎(chǔ)上，有效簡化了策略定義過程。
關(guān)鍵詞：基于屬性的訪問控制，XACML，策略模版，策略定義方法
ABSTRACT：Attribute Based Access Control (ABAC) is a new access control method in the
application of Web Service. eXtensible Access Control Markup Language (XACML) is an
important standard supporting ABAC; it brings up an ABAC policy enforcing architecture and an ABAC policy definition method. But it is very complicated to define ABAC policy using XACML, and It is difficult for common user to master it. In this paper, we analyze the definition method in XACML based on the ABAC model, bring up a XACML based policy definition template and the policy definition method based on it. In this way, we can both assure the accurate of the policy and simplify the policy definition procedure.
Keyword: Attribute BasedAccess Control, XACML, Policy template, Policy definition method