一种RBAC模型中实现否定授权的方法  

AN IMPLEMENTATION METHOD OF NEGATIVE AUTHORIZATION IN RBAC MODEL

作　　者：张世龙[1] 沈玉利[1] 

机构地区：[1]广东海洋大学信息学院,广东湛江524088

出　　处：《计算机应用与软件》2009年第5期65-67,共3页Computer Applications and Software

基　　金：国家星火项目(2007EA780068);粤港关键领域重点突破招标项目(2006A25007002)

摘　　要：针对现有基于角色访问控制RBAC(Role_based Access Control)相关模型中对否定授权研究的不足,指出用户可以获得计划外权限的问题。通过引入授权状态的概念,对RBAC模型中权限与角色之间的分配关系进行扩展,定义许可授权、收回授权、否定授权及其优先级,给出授权状态合并运算的九个规则,提出RBAC模型实施否定授权的方法。分析实现否定授权的RBAC模型性能,通过具体实例充分说明实现否定授权的RBAC模型的安全性和实用性,并在实际应用中得到实现和验证。Aiming at the deficiencies in negative authorisation research in current RBAC model, the problem that the user can obtain permissions beyond the assignment plan is pointed out. By introducing the concept of authorisation state, the distribution relation between the role and the permission in RBAC model is extended, the authorisations of grant, revoking and negative and their priorities are defined, nine rules of authorisation state combination operation are given, an implementation method of negative authorisation in RBAC model is developed. The performance of RBAC model with negative authorisation is analysed. Moreover, access control examples are provided, by which the RBAC model with negative authorisation is proved safe and useful. The method has been put into practice and proved in the application.

关 键 词：否定授权 RBAC 授权状态 合并规则 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP311.13[自动化与计算机技术—计算机科学与技术]