SPKI/SDSI2.0系统是目前最普及的信任管理系统,但它是否批准一个访问请求仅仅依赖于能否找到一条从授权源到请求者的信任链,与资源拥有者的访问策略无关,使系统的安全性受到威胁。本文利用了SPKI/SDSI2.0名字证书的特点,在一致性验证之前增加了安全性约束检查,提出了一种基于约束的SPKI/SDSI2.0一致性验证机制,使资源拥有者可以按照自己的意愿首先进行“筛选”,只有被“选中”的实体才能进行下一步的一致性验证,因此大大提高了SPKI/SDSI2.0系统的可控性和安全性.
SPKI/SDSI2.0 is the most popular trust management system at present. But in SPKI/SD- SI2.0, as long as a principal provides a valid certificate chain to the server, it may be authorized letting the resource owner's will alone, so the security property of the system can't be maintained. In this paper, we present a proof-of-compliance mechanism of SPKI/SDSI2.0 using constraint in order to enhance the degree of control over the resource for the owner. This mechanism, which is simple and flexible and easy to implement, can largely improve the security property of the distributed access control.