Abstract: XACML (extensible access control markup language) based access control technique is more and more widely used in cloud computing services. Some security problems caused by improper XACML policies, such as policy conflict and policy redundancy, are emerging. Few studies are carried out on policy conflict resolving. The existing methods can only solve conflicting rules one by one, which is not suitable for large scale cloud computing environments. To address this problem, this paper enhances the old methods of conflict detection, and presents a novel method to resolve multiple conflicts once for all. This method maps the access control rules into N-dimension space that each dimension represents an attribute, unifies the comprehensive definition of attribute conditions into several types of primitive attribute sets, and detects conflicts and redundancies by calculating the intersections of simple sets. In the policy conflict resolving algorithm, a directed acyclic graph (DAG) is used to present all conflicts, and the topology order is calculated as the priority of conflicting rules. The rules after conflict resolving are constructed according to the order of priority, to complete the one-time resolution of a large number of conflicts. Finally, the experimental results demonstrate that the algorithm is correct, feasible and efficient.

Key words: extensible access control markup language (XACML), policy management, policy conflict, conflict detection, conflict resolving

摘要： 基于XACML（extensible access control markup language）的访问控制策略在云计算服务中得到广泛使用，其存在的问题也日益凸显，策略集的冲突检测与冲突消解问题就是其中之一。然而，目前学术界在冲突消解方面研究较少，现有的研究也仅能对冲突进行逐对消解，没有针对大量冲突的一次性消解方法，这在大规模云计算环境中是很难适用的。针对这个问题，从算法的角度出发，改进了原有的策略冲突检测方法，并设计了一种新的策略冲突一次性消解算法。该算法将安全规则映射到[N]维空间中，每一个维度表示一个属性，将定义复杂的安全策略在每一个属性上统一表示为几种基本数据类型的属性值集合，通过对简单集合的交集运算来进行冲突和冗余检测。在冲突消解时，将所有的冲突汇集到一起，运用有向无环图的拓扑排序来计算规则优先级，按优先级的顺序为每个规则构建一棵空间区域选择树，选取其对应的消解后的[N]维空间区域，完成大量冲突的一次性消解。实验表明，冲突检测和一次性消解算法是正确、高效和可行的。

关键词: 可扩展的访问控制标记语言（XACML）, 策略管理, 策略冲突, 冲突检测, 冲突消解