摘要： 相对于传统的自由选择存取控制（SAC）和强制性存取控制（NIAC），基于角色的存取控制（RBAC）是一种很有前途的选择。在RBAC中，在取许可是与角色相联系的．用户需成为角色的成页以取得角色拥有的存取许可。由于RBAC不项向于某一种策略，因此可灵活适应不同的安全策略。存取矩阵模型定义了另一种实行安全策略的机制。增强型再取矩阵模型（ATAM）是分类存取矩阵模型（TAM）的一种扩展，它由Sandllu定义并成为该类模型中相当着￡的一种。ATANI通过引入强分类（即各主体或对象一旦生成并属于一种特定类型后不再改变类型）来定义。ATAM就一般性存取控制策略的正则模型而言，已被认为是当今最流行的技术。最后形式化表述了ATAM可由对RBAC元素的适当组合构造来模拟。研究结果证明了RBAC的灵活性和对大范围分布式管理模型的适应性。

关键词: 存取矩阵模型, 角色, 存取控制

Abstract: Rolc-bascd Access Control (RBAC) is a promising alternative to traditional discrctionary (DAC) and mandatory access (MAC) controls.In RBAC pcrmissions arc associated with roles, and users are made mcmbcrs of the rolcs tbcrcby acquiring the roles' permissions. RBAC is policyncutral and flexible enough to accommodate diversc security policics. Access matrix models dcnne another mechanism for enforcing the securitypolicy. The Augmcntcd Typed Access Matrix modcl (ATAM), an extension of Typed Access Matrix (TAM) model, defined by Sandllu is ell knownfrom this cIass of models. ATAM is deflned by introducing strong typing (i.e., each subject or object crtatcd is to be of partieulizd type whichthereaftcr does not change). The ATAM is recognized as the current state of thc art with respect to formal modcls fo: gencralizcd acccss controlpolicics.In this paper we formalIy show that ATAM can be simulated by appropriate connguration of RBAC componcnts. our rcsults nttcst to tlleflexihility of RBAC and its ability to accommodatc a vidc rangc of deccntralizcd administrativc modcls.

中图分类号: 

• TP309