摘 要
計算機技術安全管理的范圍很廣，可以包括網絡安全性、數據安全性、操作系統安全性以及應用程序安全性等。對一個多用戶商用應用系統而言，系統的安全訪問控制是必須的，系統不僅要滿足功能性需求，還要滿足安全性需求。系統的安全訪問控制一般是通過用戶認證和用戶權限管理來實現。各類應用系統的整個體系結構上要設計一個安全可靠、配置靈活、易擴展的安全控制模塊，它主要有兩部分內容：用戶認證和用戶權限管理。目前大致有三種安全模型：訪問矩陣、基于角色的訪問控制（RBAC-Role based access control）模型和多級模型。其中基于角色的訪問控制模型得到了日益廣泛的應用。
基于角色的訪問控制是一種新型訪問控制模型，它的基本思想是將權限與角色聯系起來，在系統中根據應用的需要為不同的工作崗位創建相應的角色，同時根據用戶職務和責任指派合適的角色，用戶通過所指派的角色獲得相應的權限，實現對文件的訪問。它支持最小特權、責任分離以及數據抽象三個基本的安全原則。
關鍵字：訪問控制；基于角色訪問控制；角色；自主訪問控制；強制訪問控制；RBAC96，ARBAC97
Research and Application on Role-Based Access Control
Abstract
The computer technology safety control scope is very broad, may include the network security, the data security, the operating system security as well as application program security and so on. Speaking of a multi user commercial application system, the system safe access control is must; not only the system must meet the functionality need, but also must meet the secure need. The system safe access control is generally realizes through the user authentication and the user jurisdiction management. In each kind of application system entire architecture must design the safety control module which a security reliable, the disposition nimble, easy to expand, it mainly has two parts of contents: User authentication and user jurisdiction management. At present approximately have three kinds of security models: Visit matrix, based on role access control (RBAC-Role based access control) model and multistage models. In which obtained day by day the widespread application based on the role access control model.
Based on the role access control is one kind of new access control model, its basic thought is relates the jurisdiction and the role, needs to found the corresponding role in the system according to the application for the different operating post, simultaneously acts according to the user duty and the responsibility designation appropriate role, the user through the role which appoints obtains the corresponding jurisdiction, realizes visit to the document. It supports the least privilege, the responsibility separation as well as the data abstract three basic security principle.
Keywords: Access control; RBAC; role; discretionary access control; mandatory access control; RBAC96; ARBAC97
目 錄
