基于任务和角色的双重Web访问控制模型  

A Task and Role-Based Access Control Model for Web

作　　者：陈伟鹤[1] 殷新春[2] 茅兵[1] 谢立[1] 

机构地区：[1]南京大学计算机软件新技术国家重点实验室,南京210093 [2]扬州大学计算机科学与工程系,扬州225009

出　　处：《计算机研究与发展》2004年第9期1466-1473,共8页Journal of Computer Research and Development

基　　金：国家"八六三"高技术研究发展计划基金项目(2 0 0 1AA14 40 10 );江苏省科技攻关基金项目 (BG2 0 0 0 0 0 6)

摘　　要：互联网 /内联网和相关技术的迅速发展为开发和使用基于Web的大规模分布式应用提供了前所未有的机遇 ,企业级用户对基于Web的应用 (Web basedapplication ,WBA)依赖程度越来越高 访问控制作为一种实现信息安全的有效措施 ,在WBA的安全中起着重要作用 但目前用来实现WBA安全的访问控制技术大多是基于单个用户管理的 ,不能很好地适应企业级用户的安全需求 因此提出了基于任务和角色的双重Web访问控制模型 (taskandrole basedaccesscontrolmodelforWeb ,TRBAC) ,它能够满足大规模应用环境的Web访问控制需求 并对如何在Web上实现TRBAC模型进行了探讨 ,提供了建议 同时 。The rapid proliferation of the Internet/Intranet and the cost effective growth of its key enabling technologies are creating unprecedented opportunities for developing large scale Web based distributed applications It has led to continued reliance on Web based applications (WBA) for enterprise wide computing At the same time, there is a growing concern over the security of WBA As an effective measure to achieve information security, access control is important in WBA security However, current approaches to access control on WBA are mostly based on individual user identity; hence they do not scale to enterprise wide systems In this paper, a new access control mechanism called TRBAC(task and role based access control model for Web,TRBAC) is presented The TRBAC model can meet the need to manage and enforce the strong and efficient access control technology in large scale Web environments The implementation of TRBAC on the Web is also illustrated Finally, the Web application adopting the TRBAC model, called E Government Official Document Flow & Processing System, is given to demonstrate the feasibility

关 键 词：角色 基于任务的访问控制 任务 WEB安全 安全cookies 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]