摘要： 针对RBAC以访问控制主体为中心,较少关注访问控制客体,造成了在权限设置和管理过程中工作量较大的问题,提出了对权限进行相应扩展的方法。该方法将权限分为操作和操作所针对的数据对象,提出了操作继承和数据对象继承概念,并在此基础上提出了权限继承概念。给出了具体的应用例子,表明该方法在权限设置和管理过程中将大大减少系统安全管理人员的工作量。

关键词: 访问控制, RBAC, 权限

Abstract: In practice, RBAC is focus on the subject, not the object of access control, thus makes a more difficult work of the setting and managing of permissions. This paper proposes a new method to solve this problem by the means of extending permission. Permission is constituted of two parts: operation and data object. There first exist two kinds of hierarchy: operation hierarchy and data object hierarchy, and then permission hierarchy . In the end, this paper introduces an application of extended permission, proves that it has greatly reduced the work of setting and managing of permissions.

中图分类号: 

• TP309