一种基于层次命名空间RBAC管理模型.pdfVIP

ISSN 1000- 1239PCN 11- 1777PTP Journal of Computer Research and De elopment 44( 12) : 2020~ 2027, 2007 RBAC 夏鲁宁 荆继武 ( 100049) ( halk@ lois1cn) An Administrative Model for Role-Based Access Control Using Hierarchical Namespace Xia Luning and Jing Jiw u ( State Key Laboratory of Inf ormation Security, Graduate University of Chinese Academy of Sciences, Beij ing 100049) Abstract Access control is an important information security mechanism1 Role-based access control is a fa- mous access control approach with good flex ibility and expandability1 T he classical RBAC models are RBAC96 and ARBAC971 The ARBAC97 model is an administrati e model w ith the idea of / using RBAC to administrate RBAC01 It facilitates decentralized administration of RBAC through three assignment models: URA97, PRA97 and RRA971 Though ARBAC97 works w ell in traditional RBAC applications, it has some shortcomings if employed in a large organization composed of many autonomous subsidiaries1 The member of an administrati e role can operate directly in the role range of a junior administrati e role, w hich iolates the autonomy of subsidiaries1 The authorization relationship is rather complex1 And the names of the roles ha e to be globally unique1 A new administrati e model named N-RBAC is proposed to o ercome these w eaknesses1 In N-RBAC, all resources ( including users and roles) are arranged into a hierarchical names- pace structure1 Thus the role hierarchy is constructed in a local space instead of in a global space1 The ad- ministrati e role hierarchy is obsolete, and a unique administrati e role is assigned to each namespace in- stead1 Experimental results show that the N-RBAC model is more suitable to autonomous distributed role administration than the ARBAC97 model1 Key words RBA