随着分布式仿真系统与Web服务技术的结合日益紧密，以及功能与资源分离的愈加明显，导致大量仿真资源暴露于网络中，传统、单一的访问控制模型已无法应对。为此提出了一种基于属性的针对功能和资源的双重访问控制模型，采用证书代理机制实现功能端单点登录，采用XACML实现资源端多属性的访问控制。详细描述了该模型的访问控制流程，目前已应用到虚拟采办系统中。通过对性能的分析和测试，证明了该双重访问控制模型的可用性和有效性。

As web service is taken up to develop distributed simulation system increasingly, the separation between functions and resources is obvious. This exposes many simulation resources to the wide area network, which are difficult for traditional and single access control models to deal with. A double access control based on attributes is proposed to achieve the access control of application function and simulation resources. The process flow of the access control is described in detail. Also, the model is realized and applied in the prototype of simulation based on acquisition system. The performance of resource access control realized on XACML is analyzed and tested, which proves the feasibility of the model.

吴慧中（1942－），女，浙江舟山市人，南京理工大学教授，研究方向为虚拟现实系统仿真