基于三员分离及数据限定的RBAC权限管理模型  

Extended RBAC rights management model based on three management roles separation and data constraints

作　　者：范收平[1] 高艳[2] 

机构地区：[1]华中光电技术研究所武汉国家光电技术实验室,武汉430074 [2]武汉冶金管理干部学院信息工程系,武汉430081

出　　处：《计算机应用》2011年第A02期112-115,共4页journal of Computer Applications

摘　　要：为提高信息系统中权限分配的适应性和安全性,提出了一种扩展的RBAC权限管理模型,通过采取一种新的类SQL数据限定方法,将权限分配中的功能权限和数据权限进行了有效结合,实现权限分配的通用性和灵活性,并通过三权分离成功解决SQL注入风险及系统管理员权限过高问题。实践证明,该模型具有通用性强、灵活方便、安全性高等优点。To improve the versatility and security of the rights management in information systems,an extended Role Based Access Control（RBAC） rights management model was brought out in this paper.The distribution of data access rights was implemented through a way similar to SQL grammar.It combined the function rights distribution and data access rights distribution efficiently.It could be used in common circumstances,and was flexible.Based on three management roles separation,it solved the problem that system administrator＇s privileges are too high and avoided the SQL injection.Practice proves that this model has versatility,flexibility,and high security.

关 键 词：信息系统 基于角色的访问控制 权限管理 数据限定 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]