基于角色的访问控制中权限滥用的限制

在实现基于角色访问控制(Role-Based Access Control，RBAC）的系统中，由于判断程序的权限仅仅根据启动该程序的角色，故一旦该程序有安全漏洞并被攻击，入侵者就会攫取该角色的全部权限进行权限滥用。该文提出程序角色(process role)的概念，并构建出动态生成程序角色的DKPRF（Double Knowledge based process Role Frame)框架，有效地限制了RBAC中权限的滥用。

Prevent Misuse of Privileges in Role-based Access Control System

In RBAC(Role-Based Access Control) system, the privileges of a process is judged only by the role that runs the process, so the attacker will get all the privileges of the role and have the opportunity to misuse those when the process has some security vulnerabilities and is attacked successfully.This paper introduces a new concept:process role,and builds a frame of DKPRF(Double Knowledge based Process Role Frame) to produce the roles dynamically,so the misuse of privileges is prevented efficiently.