信息系统中基于角色的访问控制

在一个企业级信息系统中,用户访问信息系统中资源的管理是一个复杂问题,直接对用户授权的管理模式不能适应企业的发展。文中讨论了基于角色的访问控制管理方式和ORACLE数据库管理系统的安全性策略,分析了信息系统中访问控制管理的需求,提出了对信息系统应用功能访问和数据库访问的分开控制管理,通过应用系统角色建立数据库用户和应用系统功能之间的关联,从而构成信息系统的访问控制管理策略。给出了基于角色的访问控制实现,并应用于设备信息管理系统中,实现了用户访问控制动态管理。

Access Control Based on Role in Information System

In an enterprise grade information system, it is a complex problem to manage the users accessing the information system resource. It is not able to suffice the enterprise developing for the method of accredited directly to users. The role of access control management and the security strategy of Oracle database management system are discussed. The requirement of access control management in information system is analyzed. The strategy to access control management of the application system function and the database are distinguished, and both of them are related to the database user and the application system function by the application system role. So, an information system strategy of access control management is constructed, and its implementation is also given and applied in the equipment information management system. It implements the dynamic management of users access control.