海量多源异构数据的使用授权与鉴权体系研究

Focusing on the requirements of China General Technology Research Institute for the protection of massive multi-sourced heterogeneous data, while considering universal security requirement in big data environment, we conclude the following three scientific problems: cross-system access control, dynamic authorization and extension control of massive heterogeneous data, and multi-identity authentication across multiple management domains. Based on these three scientific problems, this project intends to develop the following nine aspects: a data access control model for cross-domain data, a data access security model in a complex application environment, scenario-based access control policy generation and conflict resolution, massive data security marking, adaptive-context dynamic authorization in multi-trust systems, extended control in cross-system information exchange process, multi-entity authentication in cross-admin domain, multi-source heterogeneous data trusted authentication, and dynamic trust metrics and trust chain establishment. Finally, the project builds massive multi-source heterogeneous data access authorization and authentication prototype system. We believe the business for complex application scenarios will benefit from the research results of this project in the aspect of protection of data owner’s profit, secure and controllable data distribution, the entity cross-domain secure access, and the quality improvement of the business in complex application scenarios.

本项目聚焦于中国通用技术研究院相关业务部门对海量多源异构数据全生命周期安全使用需求，并兼顾大数据环境下普适应用的安全需求，秉承“数据跨域行、按需受控用”的指导思想，凝练出“跨域访问控制、海量异构数据动态授权与延伸控制、跨管理域的多元身份鉴权”三个科学问题；针对这三个科学问题，本项目拟从面向跨域数据受控共享的访问控制模型、复杂应用环境下的数据访问安全模型、场景适应的访问控制策略生成与冲突消解、海量异构数据的安全标记、多信任体制下场景自适应的动态授权、跨系统信息交换的延伸控制、多元实体跨管理域身份认证、多源异构数据可信认证、信任动态度量与信任链构建等九个方面开展研究，研发海量多源异构数据的使用授权与鉴权原型系统。本项目的实施对复杂应用场景中数据共享安全可控、实体跨域安全接入、数据所有者权益保护和业务服务质量提升具有重要的理论意义和实用价值。

针对海量多源异构数据使用授权与鉴权中数据异构多源化、应用环境复杂化、数据访问跨域化、安全敏感性差异化、信任体制多样化、防护能力差异化、多域认证交叉化、数据共享广域化、信任关系动态化等本质特征，本项目围绕跨域访问控制、海量异构数据动态授权与延伸控制、跨管理域的多元身份鉴权三个科学问题展开研究，提出了跨域受控共享访问控制模型与数据访问安全模型、跨系统信息交换的延伸控制机制；突破了访问控制策略生成与冲突消解、海量异构数据的安全标记与场景自适应动态授权、场景自适应的多因子按需组合用户身份认证等关键技术；研发了多源异构数据使用授权与鉴权原型系统、安全存储统一访问控制和授权原型系统、跨系统异构数据共享的访问审计原型系统。可支撑海量多源异构数据的细粒度受控共享。