一种基于角色访问控制模型的约束规范描述

传统的访问控制主要有自主型的访问控制DAC(Discretionary Access Control)和强制型的访问控制MAC(Mandatory Access Control)。强制型访问控制是“强加”给访问主体的,即系统强制主体服从访问控制政策。自主型的访问控制是在确认主体身份以及它们所属的组的基础上,对访问进行限定的一种方法。随着企业规模的增大,企业的信息化管理变得越来越重要,企业级访问控制和安全管理设计将是最难解决的问题之一,DAC和MAC已不能满足需要。20世纪90年代

Constraint Specification for the Model of Role-Based Access Control

The access control is very important for the information management of modern enterprises . This paper proposes a framework of well.defined constraint specifications for developers to build application.level access control based on users' roles. They ensure that each role is configured with consistent privileges, each actor is authorized to proper roles and then each actor can activate and play his authorized roles without interest conflicts. These formal constraint specifications are described by the first.order predicate logic, and also some properties are proved. The model provides relatively independent, consistent and inferable constraint specifications for developers to design access control of large and complex enterprise systems.