摘 要
计算机技术安全管理的范围很广，可以包括网络安全性、数据安全性、操作系统安全性以及应用程序安全性等。对一个多用户商用应用系统而言，系统的安全访问控制是必须的，系统不仅要满足功能性需求，还要满足安全性需求。系统的安全访问控制一般是通过用户认证和用户权限管理来实现。各类应用系统的整个体系结构上要设计一个安全可靠、配置灵活、易扩展的安全控制模块，它主要有两部分内容：用户认证和用户权限管理。目前大致有三种安全模型：访问矩阵、基于角色的访问控制（RBAC-Role based access control）模型和多级模型。其中基于角色的访问控制模型得到了日益广泛的应用。
基于角色的访问控制是一种新型访问控制模型，它的基本思想是将权限与角色联系起来，在系统中根据应用的需要为不同的工作岗位创建相应的角色，同时根据用户职务和责任指派合适的角色，用户通过所指派的角色获得相应的权限，实现对文件的访问。它支持最小特权、责任分离以及数据抽象三个基本的安全原则。
关键字：访问控制；基于角色访问控制；角色；自主访问控制；强制访问控制；RBAC96，ARBAC97
Research and Application on Role-Based Access Control
Abstract
The computer technology safety control scope is very broad, may include the network security, the data security, the operating system security as well as application program security and so on. Speaking of a multi user commercial application system, the system safe access control is must; not only the system must meet the functionality need, but also must meet the secure need. The system safe access control is generally realizes through the user authentication and the user jurisdiction management. In each kind of application system entire architecture must design the safety control module which a security reliable, the disposition nimble, easy to expand, it mainly has two parts of contents: User authentication and user jurisdiction management. At present approximately have three kinds of security models: Visit matrix, based on role access control (RBAC-Role based access control) model and multistage models. In which obtained day by day the widespread application based on the role access control model.
Based on the role access control is one kind of new access control model, its basic thought is relates the jurisdiction and the role, needs to found the corresponding role in the system according to the application for the different operating post, simultaneously acts according to the user duty and the responsibility designation appropriate role, the user through the role which appoints obtains the corresponding jurisdiction, realizes visit to the document. It supports the least privilege, the responsibility separation as well as the data abstract three basic security principle.
Keywords: Access control; RBAC; role; discretionary access control; mandatory access control; RBAC96; ARBAC97
目 录
