支持授权委托的细粒度角色访问控制模型

A Delegation-Supported & Fine-Grained Access Control Model Based on Role

针对传统RBAC模型在大型综合集成系统中的权限管理以及访问控制的不足,从授权委托和访问控制的细粒度方面对RBAC模型进行扩充,通过将客体资源按主体的意图以尽量小的粒度分解和设置角色属性以实现细粒度的访问控制,附加时间约束来增强模型对角色、权限、委托等的约束能力,并且引入授权委托机制以及角色组的概念,解决了综合系统授权管理的复杂性和集中性问题.

For improving of permission management and access control in complex integrated system, an extended role-based access control model is proposed which supports delegation and fine-grained aecess control. The model decomposes objects to less granularities by purpose of subjects and defines role attributes to realize fine-grained access control, appends time constrains to strengthen capacity of constraints for roles, permissions and delegation, and introduces delegation mechanism and role groups to solve the complexity and centralization questions of integrated system.