一种具有时间约束的基于角色的授权管理模型

A Temporal Role-Based Administration of Authorization Model

针对大型系统中角色权限管理的复杂性,提出了一种具有时间约束的基于角色的授权管理模型.考虑到用户权限通常包括私有权限、部门权限及公有权限,并存在权限频繁变动等问题,该模型扩展了权限定义,在权限定义中增加了权限的传播深度参数,即增加了可被继承的次数,使该参数与现实世界中的各级岗位数及权限类型相对应.另外,该模型在权限的继承中也加入了时间约束,使得只有满足时间条件要求的角色的权限才可以被继承.结果表明,该模型不仅有利于权限的频繁更新,也对应了现实世界中的岗位数,易于理解与操作.

As the role administration of authorization in large system is complex, a temporal role-based administration of authorization model is proposed in this paper. Consider that the user permission usually includes private permission, department permission and public permission, and the permission need update frequently, so the model expands the definition of permissions by adding a parameter of permission transmitting depth, i.e. the number that the permission can be inherited, which corresponds to the number of posts and the kind of permission in reality. And further, the model adds temporal constraint in permissions inheritance, i.e. only the permissions owned by the role that meets time requirement can be inherited. The model not only benefits from permissions update frequently, but also corresponding to the number of posts in reality, and it is easy to understand and operate.