基于树型角色的访问控制策略及其实现

对于工作职能耦合度高、业务呈交叉状的企业，传统的基于用户或角色的访问控制(RBAC)策略已难以实现信息系统的权限管理．文中结合RBAC的基本思想，提出了一种分层的树型角色访问控制(TRBAC)模型，并在应用程序层实现了基于角色的权限管理方案，实践表明，TRBAC简化了用户、角色和许可三者之间的配置规则，方便了系统的授权管理．

A Tree Role-based Access Control Strategy and Its Implementation

For the enterprises characterized by high-coupling jobs and crossing businesses, it is difficult to implement the administration of information system privilege by utilizing the traditional access control strategies based on user or role. In this paper, according to the basic theory of the RBAC (Role-based Access Control), a multi-layered TRBAC (Tree Role-based Access Control) model was presented and a role-based privilege administration scheme was implemented in the application layer. The practical example indicates that the TRBAC simplifies the configuration rules of user, role and permission, and makes the privilege management more convenient.