基于数据对象的RBAC权限访问控制模型  

RBAC permission access control model based on data objects

作　　者：赵静[1] 杨蕊[1] 姜滦生[1] 

机构地区：[1]燕山大学里仁学院,河北秦皇岛066004

出　　处：《计算机工程与设计》2010年第15期3353-3355,3389,共4页Computer Engineering and Design

基　　金：秦皇岛市科学技术研究与发展计划基金项目(200901A035)

摘　　要：针对传统的基于角色的权限访问控制模型没有考虑数据对象权限分配的缺点,提出一种基于数据对象的RBAC(role-based access control)模型。该模型基本思想是:用户和角色不直接相连,而是通过数据对象把用户和角色相联系,同时将角色对象分为公有角色和私有角色,使得同一用户的不同数据对象,可以拥有不同的功能访问权限。实验结果表明,该模型有效地实现了数据权限和功能权限的分离,改善了传统RBAC模型权限管理模式。The shortcomings that the data objects are not involved in the traditional description of permission model on RBAC are pointed out.An improved permission access control is proposed to improve the problem called D-RBAC（Data-RBAC）.The basic idea of the model is that users and roles are not connected directly but are put together by data objects.And the role objects are divided into public roles and private roles,and with this method the user which owns different data objects could have different function access permission.It is shown by practice that this model can effectively separate the data permission with the function permission and improve the traditional RBAC permission access model to solve the mentioned problem.

关 键 词：基于角色的访问控制 权限管理 数据对象 公有角色 私有角色 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]