基于角色的访问控制中权限滥用的限制  

Prevent Misuse of Privileges in Role-based Access Control System

作　　者：王超[1] 

机构地区：[1]南京大学计算机科学与技术系,南京210093

出　　处：《计算机工程》2004年第6期53-55,132,共4页Computer Engineering

基　　金：国家"863"高技术资助项目(2001AA144010)

摘　　要：在实现基于角色访问控制(Role-Based Access Control，RBAC)的系统中，由于判断程序的权限仅仅根据启动该程序的角色，故一旦该程序有安全漏洞并被攻击，入侵者就会攫取该角色的全部权限进行权限滥用。该文提出程序角色(process role)的概念,并构建出动态生成程序角色的DKPRF(Double Knowledge based Process Role Frame)框架，有效地限制了RBAC中权限的滥用。In RBAC(Role-Based Access Control) system, the privileges of a process is judged only by the role that runs the process, so the attacker will get all the privileges of the role and have the opportunity to misuse those when the process has some security vulnerabilities and is attacked successfully.This paper introduces a new concept:process role,and builds a frame of DKPRF(Double Knowledge based Process Role Frame) to produce the roles dynamically,so the misuse of privileges is prevented efficiently.

关 键 词：基于角色访问控制 程序角色 基于双层知识的程序角色生成框架 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]