摘要：

针对Web系统中普通用户越权访问未授权的系统资源以及未授权用户非法访问系统资源带来的信息安全问题,分析越权访问的发生原理,利用基于角色的访问控制技术和Shiro框架的授权机制,同时结合文本设计权限访问控制算法,实现对系统各模块不同权限灵活、安全的管理。分析结果表明,该算法能有效阻止越权访问,提高系统安全性。

关键词: 授权, 越权访问控制, 信息安全, 角色, 权限

Abstract:

For information security issues that the normal users unauthorized access to unauthorized system resources and unauthorized users access to system resources illegally in Web system,this paper analyzes the principle of the Broken Access Control(BAC),uses the access control technology based on the role and authorization mechanism of the Shiro framework,and proposes an authority access control algorithm,which realizes flexible and safe management to different modules in the system.Analysis result shows that this algorithm can effectively prevent the BAC and improve security of the system.

Key words: authorization, Broken Access Control(BAC), information safety, role, authority

中图分类号: 

• TP311