通信经营系统中角色访问控制的实现资料.docVIP

摘 要 中国网通汕头分公司通信经营信息系统是一个大型分布式系统，用于公司通信经营业务信息的管理，涉及面广，数据量大，信息敏感程度各不相同，系统对信息的安全管理有较高的要求。访问控制是实现信息系统安全的一项重要机制，通过实施访问控制，可以在信息系统中限制对关键资源的访问，防止非法用户的侵入或合法用户因不慎操作所造成的破坏。传统的访问控制技术如自主访问控制和强制访问控制授权管理复杂，无法满足系统的安全需求。在通信经营信息系统的访问控制管理中，采用了基于角色的访问控制技术。 由于部门多，管理分散，通信经营信息系统的安全管理需要实施多种安全策略。基于角色的访问控制技术，利用角色沟通用户与权限，提供了灵活的授权管理。针对通信经营过程主体在不同的业务状态需要不同的访问授权的特点，系统根据业务管理的需要，对权限进行动态管理，根据岗位职责划分角色，利用角色的层次关系和角色约束，在访问控制管理中实现了职责分离和最小特权策略。 通信经营信息系统由多个业务子系统组成，访问控制子系统以模块化设计，通过接口灵活地为各个业务子系统提供访问控制管理。针对业务子系统安全策略多样和多变的特点，访问控制系统利用访问规则对访问控制策略进行描述，通过不变的安全机构实现多变的安全策略。 关键词：通信经营信息系统，访问控制，角色，安全策略 Abstract The Market Management Information System (STMMIS, for short), which is used to manage the telecom market management information by China Netcom Corporation LTD. ShanTou Branch, is a distributed management information system. With many departments and many users are involved, and much more sensitive data should be protected, STMMIS needs more security measures to keep the data from destroy, or be used in safety mode. Access control is an important part of security mechanisms used in management information system. Using access control, we can grant or deny a user to visit STMMIS according to the policy, whether he is legal or illegal for the system. Nevertheless, some traditional approaches, such as Discretionary Access Control and Mandatory Access Control, are not suitable for STMMIS where more sophisticated access control is needed. As a result, RBAC is adopted in the development of the access control system of STMMIS. The departments and the users that STMMIS involved spreading around in Chaosan, and the users who need to visit STMMIS are managed in the departments he worked in, so much more safety policy is used in STMMIS access control. Using the basic idea of RBAC, we can offer more flexible security measures in STMMIS access control by roles relationship. For the same user, the access permission is different when the operation he involved is in different status. Apart from an introduction to STMMIS, mu