基于RBAC模式权限管理系统的设计和实现.pdf

Abstract Abstract Atpresent,information managemem system has been avery popular universal rate,but thesecurity work e avery specific linkmay besubject tosecurity threats ininformation building astrong authoritymanagement system toguarantee thesecurity isveryimportant. Thisdissertationproposed aconfigurable,universal authorizationmanagement system based on study RBAC scheme andanalysis RBAC system isalso used foranalyzing the whole system SO as plete thehierarchicaldesign according totheMVC implemem thesystem,the popular J2EE technology such asStruts,Spring,Hibernate isapplied forthe application thiskindofframeworks,the pre-designed functionshave been developed inlinewith themodules system includes user information management,role information management,module information anization information management,source dam management functions and SO on,this pleted thesystem needsanalysis, system design,detailed design andRealization ofsystem ofgeneraldescription. Demandanalysis anddescribes themain functions of thissystem and thisarticle mainly research system isdesigned tofocus on the functionalmodules ofthebusiness flow foreachsubmoduledesign. The system Was created to maintain differentpeople with different access beanauthorizationsystem whichCan configure,thesystem alsoCan help meettheconvenience,safety,higll efficiency ofenterprise information system authority management. KeyWords:AuthorizationManagement;RBAC Scheme;J2EE m 第一章绪论 ,一般指根据系统设置的安全规则或者安全策略,用户可以访问而且只能访问自己被授权的资源,不多不少。访问控制是针对越权使用资源的防御措施。基本目标是为了限制访问主体(用户、进程、服务等)对访问客体(文件、系统等)的访问权限,从而使计算机系统在合法范围内使用;决定用户能做什么, 也决定代表一定用户利益的程序能做什么。企业环境中的访问控制策略一般有三种:自主型访问控制方法、强制型访问控制方法和基于角色的访问控制方法 RBAC(Role Based AccessContr01)。其中,自主式太弱,强制式太强,二者工作量大,不便于管理,基于角色的访问控制方法是目前公认的解决大型企业的统一资源访问控制的有效方法。其显著的两大特征是:l、减小授权管理的复杂性, 降低管理开销;2、灵活地支持企业的安全策略,并对企业的变化有很大的伸缩性。不良的权限管理系统,必然留下系统漏洞