下载文档原格式
基于对象的RBAC权限控制模型在Web系统中的应用随着互联网的不断发展，Web系统已经成为人们日常生活中不可或缺的一部分。
而随着Web系统的快速扩展和用户数量的增加，对于系统安全和权限控制的需求也越来越高。
为了保证Web系统的安全性和可靠性，RBAC（Role Based Access Control）权限控制模型应运而生。
本文将详细介绍基于对象的RBAC权限控制模型在Web系统中的应用。
一、RBAC权限控制模型概述RBAC（Role Based Access Control）权限控制模型是一种基于角色的访问控制模型，其核心思想是将用户的访问权限与其角色进行关联，从而使用户在系统中使用其拥有的角色和权限进行操作。
RBAC权限控制模型是目前应用最广泛、功能最完善的访问控制模型之一，它将用户抽象成角色，将权限抽象成资源，并将角色和资源之间的访问控制进行了明确的定义和规范化。
与其他访问控制模型相比，RBAC权限控制模型具有以下优点：（1）简化了权限管理：RBAC模型将所有用户的权限集中在管理员手中，减少了权限管理的复杂性；（2）提高了系统的安全性：通过RBAC模型的角色与权限授权方式，可以有效限制用户的访问权限，保证系统的安全性；（3）便于扩展：当系统增加新的角色、新的功能或新的用户时，可以很容易地修改权限信息，而不影响原来的权限设置。
二、RBAC模型在Web系统中的实现Web系统是一个复杂的软件系统，具有非常广泛的应用场景。
对于Web系统而言，如何实现RBAC授权管理是非常重要的。
本节将详细介绍RBAC模型在Web系统中的实现。
（1）权限管理Web系统中权限管理一般分为两个部分：页面控制和方法控制。
页面控制主要是指对Web页面的访问进行控制，而方法控制则是指对系统中的方法进行控制。
在RBAC模型中，页面控制的权限由角色直接控制，而方法控制的权限由角色和资源之间的关系控制。
例如，对于系统中的一个方法，我们可以针对某个角色设置是否允许访问该方法，如果该角色未被授予权限，则该方法将无法访问。
文献翻译基于 Web 的分析系统院（系）名称信息工程学院专业名称软件工程英文译文基于Web 的分析系统马克斯科特，约翰琳1 摘要在使用分析型数据库时，分析人员将数据归入公用组，并尝试确定条件变化时产生的结果。
例如，提高产品价格会增加单位利润，但可能会减少销量ù会产生较高还是较低的总利润？或者，联邦贴现率的下降会如何影响房地产贷款的收益？为了帮助分析人员根据历史趋势做出有根据的预测，Microsoft 在SQL Server 2000 中提供了分析服务，在SQL Server 7.0 中提供了OLAP 服务。
这些服务都提供OLAP 功能，能够将存储在SQL Server（或任何其他OLE DB 兼容的数据源）上的数据处理成多维数据结构，称为多维数据集。
多维数据集简化了趋势分析和建立实体间交互方式联系的过程。
例如，房地产投资者采用现金流模型来区分一组具有共同特征（如：地产类型、地理位置和利率范围）的贷款，并预测各种事件的影响。
如果贷款提前偿还或者借款人违约，后果将会如何？此类不可预测的事件会如何影响贷款所担保的债券的收益。
从包含几百笔贷款的清单中选择并区分具有分析特征的贷款是需要相当技巧的。
分析服务和OLAP 服务有助于在各组贷款间建立联系，以便分析人员能够建立贷款假设模型。
为了帮助客户的房地产分析人员预测商业抵押证券的业绩，我们的开发小组需要设计一个以各种方式（如：利率、到期期限或地产位置）来简化贷款分类的系统。
其界面应易于学习和使用。
而且，所开发的系统需要在Internet 上进行安全的部署。
为了满足这些要求，开发小组选择了分析服务。
2 在Web上部署Office在选定了后端技术后，开发小组开始制订实现前端界面的计划。
多数金融分析人员使用Microsoft Excel，他们对其界面比较熟悉，感觉也很舒服。
Excel 包括数据透视表服务，能够允许分析人员连接到分析服务数据库。
Excel 的拖放界面提供了对多维数据的简单和直观的访问，并不要求用户进行深入的培训。
A Clear Look at Internal Controls: Theory and ConceptsHammed Arad (Philae)Department of accounting, Islamic Azad University, Hamadan, IranBarak Jamshedy-NavidFaculty Member of Islamic Azad University, Kerman-shah, IranAbstract: internal control is an accounting procedure or system designed to promote efficiency or assure the implementation of a policy or safeguard assets or avoid fraud and error. Internal Control is a major part of managing an organization. It comprises the plans, methods, and procedures used to meet missions, goals, and objectives and, in doing so, support performance-based management. Internal Control which is equal with management control helps managers achieve desired results through effective stewardship of resources. Internal controls should reduce the risks associated with undetected errors or irregularities, but designing and establishing effective internal controls is not a simple task and cannot be accomplished through a short set of quick fixes. In this paper the concepts of internal controls and different aspects of internal controls are discussed. Keywords: Internal Control, management controls, Control Environment, Control Activities, Monitoring1. IntroductionThe necessity of control in new variable business environment is not latent for any person and management as a response factor for stockholders and another should implement a great control over his/her organization. Control is the activity of managing or exerting control over something. he emergence and development of systematic thoughts in recent decade required a new attention to business resource and control over this wealth. One of the hot topic a bout controls over business resource is analyzing the cost-benefit of each control.Internal Controls serve as the first line of defense in safeguarding assets and preventing and detecting errors and fraud. We can say Internal control is a whole system of controls financial and otherwise, established by the management for the smooth running of business; it includes internal cheek, internal audit and other forms of controls.COSO describe Internal Control as follow. Internal controls are the methods employed to help ensure the achievement of an objective. In accounting and organizational theory, Internal control is defined as a process effected by an organization's structure, work and authority flows, people and management information systems, designed to help the organization accomplish specific goals or objectives. It is a means by which an organization's resources are directed, monitored, and measured. It plays an important role in preventing and detecting fraud and protecting the organization's resources, both physical (e.g., machinery and property) and intangible (e.g., reputation or intellectual property such as trademarks). At the organizational level, internal control objectives relate to the reliability of financial reporting, timely feedback on the achievement of operational or strategic goals, and compliance with laws and regulations. At the specific transaction level, internal control refers to the actions taken to achieve a specific objective (e.g., how to ensure the organization's payments to third parties are for valid services rendered.) Internal controlprocedures reduce process variation, leading to more predictable outcomes. Internal controls within business entities are called also business controls. They are tools used by manager's everyday.* Writing procedures to encourage compliance, locking your office to discourage theft, and reviewing your monthly statement of account to verify transactions are common internal controls employed to achieve specific objectives.All managers use internal controls to help assure that their units operate according to plan, and the methods they use--policies, procedures, organizational design, and physical barriers-constitute. Internal control is a combination of the following：1. Financial controls, and2. Other controlsAccording to the institute of chartered accountants of India internal control is the plan of organization and all the methods and procedures adopted by the management of an entity to assist in achieving management objective of ensuring as far as possible the orderly and efficient conduct of its business including adherence to management policies, the safe guarding of assets prevention and detection of frauds and error the accuracy and completeness of the accounting records and timely preparation of reliable financial information, the system of internal control extends beyond those matters which relate to the function of accounting system. In other words internal control system of controls lay down by the management for the smooth running of the business for the accomplishment of its objects. These controls can be divided in two parts i.e. financial control and other controls.Financial controls:- Controls for recording accounting transactions properly.- Controls for proper safe guarding company assets like cash stock bank debtor etc- Early detection and prevention of errors and frauds.- Properly and timely preparation of financial records I e balance sheet and profit and loss account.- To maximize profit and minimize cost.Other controls: Other controls include the following:Quality controls.Control over raw materials.Control over finished products.Marketing control, etc6. Parties responsible for and affected by internal controlWhile all of an organization's people are an integral part of internal control, certain parties merit special mention. These include management, the board of directors (including the audit commit tee), internal auditors, and external auditors.The primary responsibility for the development and maintenance of internal control rests with an organization's management. With increased significance placed on the control environment, the focus of internal control has changed from policies and procedures to an overriding philosophy and operating style within the organization. Emphasis on these intangible aspects highlights the importance of top management's involvement in the internal control system. If internal control is not a priority for management, then it will not be one for people within the organization either.As an indication of management's responsibility, top management at a publicly owned organization will include in the organization's annual financial report to the shareholders a statement indicating that management has established a system of internal control that management believes is effective. The statement may also provide specific details about the organization's internal control system.Internal control must be evaluated in order to provide management with some assurance regarding its effectiveness. Internal control evaluation involves everything management does to control the organization in the effort to achieve its objectives. Internal control would be judged as effective if its components are present and function effectively for operations, financial reporting, and compliance. he boards of directors and its audit committee have responsibility for making sure the internal control system within the organization is adequate. This responsibility includes determining the extent to which internal controls are evaluated. Two parties involved in the evaluation of internal control are the organization's internal auditors and their external auditors.Internal auditors' responsibilities typically include ensuring the adequacy of the system of internal control, the reliability of data, and the efficient use of the organization's resources. Internal auditors identify control problems and develop solutions for improving and strengthening internal controls. Internal auditors are concerned with the entire range of an organization's internal controls, including operational, financial, and compliance controls.Internal control will also be evaluated by the external auditors. External auditors assess the effectiveness of internal control within an organization to plan the financial statement audit. In contrast to internal auditors, external auditors focus primarily on controls that affect financial reporting. External auditors have a responsibility to report internal control weaknesses (as well as reportable conditions about internal control) to the audit committee of the board of directors.8. Limitations of an Entity's Internal ControlInternal control, no matter how well designed and operated, can provide only reasonable assurance of achieving an entity's control objectives. The likelihood of achievement is affected by limitations inherent to internal control. These include the realities that human judgment in decision-making can be faulty and that breakdowns in internal control can occur because of human failures such as simple errors or mistakes. For example, errors may occur in designing,Maintaining, or monitoring automated controls. If an entity’s IT personnel do not completely understand how an order entry system processes sales transactions, they may erroneously design changes to the system to process sales for a new line of products. On the other hand, such changes may be correctly designed but misunderstood by individuals who translate the design into program code. Errors also may occur in the use of information produced by IT. For example, automated controls may be designed to report transactions over a specified dollar limit for management review, but individuals responsible for conducting the review may not understand the purpose of such reports and, accordingly, may fail to review them or investigate unusual items.Additionally, controls, whether manual or automated, can be circumvented by the collusion of two or more people or inappropriate management override of internal control. For example, management may enter into side agreements with customers that alter the terms and conditions of the entity’s standard sales con tract in ways that would preclude revenuerecognition. Also, edit routines in a software program that are designed to identify and report transactions that exceed specified credit limits may be overridden or disabled.Internal control is influenced by the quantitative and qualitative estimates and judgments made by management in evaluating the cost-benefit relationship of an entity’s internal control. The cost of an entity's internal control should not exceed the benefits that are expected to be derived. Although the cost-benefit relationship is a primary criterion that should be considered in designing internal control, the precise measurement of costs and benefits usually is not possible.Custom, culture, and the corporate governance system may inhibit fraud, but they are not absolute deterrents. An effective control environment, too, may help reduce the risk of fraud. For example, an effective board of directors, audit committee, and internal audit function may constrain improper conduct by management. Alternatively, the control environment may reduce the effectiveness of other components. For example, when the nature of management incentives increases the risk of material misstatement of financial statements, the effectiveness of control activities may be reduced.9. Balancing Risk and ControlRisk is the probability that an event or action will adversely affect the organization. The primary categories of risk are errors, omissions, delay and fraud In order to achieve goals and objectives, management needs to effectively balance risks and controls. Therefore, control procedures need to be developed so that they decrease risk to a level where management can accept the exposure to that risk. By performing this balancing act "reasonable assurance” can be attained. As it relates to financial and compliance goals, being out of balance can causebe proactive, value-added, and cost-effective and address exposure to risk.11. ConclusionThe concept of internal control and its aspects in any organization is so important, therefore understanding the components and standards of internal controls should be attend by management. Internal Control is a major part of managing an organization. Internal control is an accounting procedure or system designed to promote efficiency or assure the implementation of a policy or safeguard assets or avoid fraud and error. According to custom definition, Internal Control is a process affected by an entity's board of directors, management and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following categories namely. The major factors of internal control are Control environment, Risk assessment, Control activities, Information and communication, Monitoring. This article reviews the main standards and principles of internal control and described the relevant concepts of internal control for all type of company.内部控制透视：理论与概念哈米德阿拉德（Philae）会计系，伊斯兰阿扎德大学，哈马丹，伊朗巴克Joshed -纳维德哈尼学院会员伊斯兰阿扎德大学，克尔曼伊朗国王，伊朗摘要：内部控制是会计程序或控制系统，旨在促进效率或保证一个执行政策或保护资产或避免欺诈和错误。
计算机 JSP web 外文翻译外文文献12.1 nEffective web n design involves separating business objects。
n。
and object XXX。
Although one individual may handle both roles on a small-scale project。
it is XXX.12.2 JSP ArchitectureIn this chapter。
XXX using JavaServer Pages。
servlets。
XXX of different architectures。
each building upon the us one。
The diagram below outlines this process。
and we will explain each component in detail later in this article.Note: XXX.)When Java Server Pages were introduced by Sun。
some people XXX。
While JSP is a key component of the J2EE n and serves as the preferred request handler and response mechanism。
it is XXX.XXX JSP。
the XXX that JSP is built on top of the servlet API and uses servlet XXX interesting ns。
such as whether we should XXX in our Web-enabled systems。
and if there is a way to combine servlets and JSPs。
附录附录一：文献资料原文J2EE WEB应用架构分析1、架构概述J2EE体系包括java server pages(JSP) ,java SERVLET, enterprise bean，WEB service等技术。
这些技术的出现给电子商务时代的WEB应用程序的开发提供了一个非常有竞争力的选择。
怎样把这些技术组合起来形成一个适应项目需要的稳定架构是项目开发过程中一个非常重要的步骤。
完成这个步骤可以形成一个主要里程碑基线。
形成这个基线有很多好处：各种因数初步确定：为了形成架构基线，架构设计师要对平台（体系）中的技术进行筛选，各种利弊的权衡。
往往架构设计师在这个过程中要阅读大量的技术资料，听取项目组成员的建议，考虑领域专家的需求，考虑赞助商成本（包括开发成本和运行维护成本）限额。
一旦架构设计经过评审，这些因数初步地就有了在整个项目过程中的对项目起多大作用的定位。
定向技术培训：一旦架构师设计的架构得到了批准形成了基线，项目开发和运行所采用的技术基本确定下来了。
众多的项目经理都会对预备项目组成员的技术功底感到担心；他们需要培训部门提供培训，但就架构师面对的技术海洋，项目经理根本就提不出明确的技术培训需求。
怎不能够对体系中所有技术都进行培训吧！有了架构里程碑基线，项目经理能确定这个项目开发会采用什么技术，这是提出培训需求应该是最精确的。
不过在实际项目开发中，技术培训可以在基线确定之前与架构设计并发进行。
角色分工：有了一个好的架构蓝图，我们就能准确划分工作。
如网页设计，JSP 标签处理类设计，SERVLET 设计，session bean设计，还有各种实现。
这些任务在架构蓝图上都可以清晰地标出位置，使得项目组成员能很好地定位自己的任务。
一个好的架构蓝图同时也能规范化任务，能很好地把任务划分为几类，在同一类中的任务的工作量和性质相同或相似。
这样工作量估计起来有一个非常好的基础。
运行维护：前面说过各个任务在架构图上都有比较好的定位。
中文5270字毕业设计(论文)外文资料翻译系（院）：专业班级：计算机科学与技术姓名：学号：外文出处： /(用外文写)附件： 1.外文资料翻译译文；2.外文原文。
指导教师评语：外文资料紧扣毕业设计课题，翻译准确、文字流畅、语句通顺，信息量足，能够独立按时完成翻译工作。
签名：年月日注：请将该封面与附件装订成册。
附件1：外文资料翻译译文VBA的开发环境本文主要讨论怎样在VBA开发环境中进行编程，通过对路径、目录以及场景所显示的对象的访问，来对它们进行控制和操作。
代码通过设置和获取它们接口的属性来操作对象，例如，设置窗口的最大化和最小化；代码还可以通过运用接口的方法来操作对象，例如，可以在多线中添加一个点；另外，代码还可以设置一个区域的值。
当一个事件发生时，代码随之而运行。
例如，当用户打开一个文档，点击一个按钮，或是通过修改一个正在编辑的草图来更新数据时，都会引发代码的运行。
在我们学习VBA开发环境之前，我们先来了解一下有关VBA的一些概念。
什么Visual Basic for Application 呢？Visual Basic for Application 是Microsoft Visual Basic 系列的一部分。
Microsoft Visual Basic 系列还包括Visual Basic 开发系统（主要有学习版本、专业版本和企业版本）和Visual Basic 脚本版本（VBScript）。
VBA是一个嵌入式的编程开发环境，它可以帮助开发者借助Microsoft Visual Basic的能力来解决客户端的问题。
开发者通过使用基于VBA的应用，可以自动的延伸应用的函数功能。
缩短开发客户端业务的解决问题的周期性。
Visual Basic、VBA以及VBScript之间的区别是什么？我们什么时候使用其中的一种应用而取代另一种应用呢？Visual Basic是一个用于建立单独的软件部件的标准独立工具，例如，我们可以用它来编辑可执行的程序，COM 部件和动态插件控制。
基于组织的Web服务访问控制模型李怀明;王慧佳;符林【摘要】For the problem of current access control strategies difficultly guaranteeing the flexibility of authorization of complex E-government system for Web service,this paper proposes an organization-based access control model for Web services on the basis of the research of the organization-based 4 level access control model. The model takes organization as the core and studies the issue of access control and authorization management from the perspective of management. Through importing the position agent and authorization unit in the model,the authorization can be adjusted according to the change of the environment context information to implement the dynamic authorization,while taking advantage of the state migration of authorization units,provides support for workflow patterns. Furthermore,the model divides permissions into service permissions and service attribute permissions, and achieves fine-grained resource protection. Application examples show that the model can commendably fit the complex organization structure in E-government system. Moreover,it can make authorization more efficient and flexible meanwhile protecting the Web service resources.%针对现有访问控制策略难以保障面向Web服务的复杂电子政务系统授权的灵活性问题，在研究基于组织的四层访问控制模型(OB4LAC)的基础上，提出一种基于组织的Web服务访问控制模型。
网络设计与规划中英文对照外文翻译文献现代企业面临的挑战尽管企业进行了大量的IT资本投资，但许多公司发现，大部分关键网络资源和信息资产仍处于自由状态。
实际上，许多"孤立"的应用程序和数据库无法相互通信，这是一种常见的商业现象。
2.The n: Service-Oriented ork Architecture (SONA)___'___(SONA) ___ is based on a service-oriented architecture (SOA) approach。
___.解决方案：面向服务的网络架构（SONA）___的面向服务的网络架构（SONA）是一个全面的框架，帮助企业克服网络设计和规划的挑战。
SONA基于面向服务的架构（SOA）方法，使企业能够将不同的应用程序和数据库集成到一个统一的网络中。
3.___ SONABy implementing SONA。
businesses ___ of benefits。
___。
increased security。
___。
___ security features。
such as identity and access management。
to protect critical n assets。
Finally。
___.SONA的好处通过实施SONA，企业可以获得许多好处，包括提高网络敏捷性、增加安全性和降低成本。
SONA通过提供灵活和可扩展的网络架构，使企业能够快速适应不断变化的业务需求。
此外，SONA提供了增强的安全功能，如身份和访问管理，以保护关键信息资产。
最后，SONA通过简化网络管理和减少对额外硬件和软件的需求，帮助企业降低成本。
4.nIn today's fast-paced business environment。
it is essential for ___。
secure。
and cost-effective ork architecture.结论在今天快节奏的商业环境中，企业必须拥有一个可以快速适应不断变化的业务需求的网络基础设施。
第24卷第4期2003年7月 江苏大学学报(自然科学版)Journal o f Jiang su U niversity(N atural Science Edition)V ol.24No.4July2003根据任务和角色进行Web访问控制陈继明,宋顺林(江苏大学计算机科学与通信工程学院,江苏镇江212013)[摘 要]访问控制作为一种实现信息安全的有效措施,在基于Web的应用(Web-based applica tion,WBA)的安全中起着重要作用 但目前用来实现WBA安全的访问控制技术大多是基于单个用户管理的,不能很好的适应企业级用户的安全需求 笔者提出了一种根据任务和角色进行Web 访问控制的方法,它能够满足大规模应用环境的Web访问控制需求[关键词]Web安全;访问控制;角色;任务[中图分类号]TP393 08A [文献标识码]A [文章编号]1671-7775(2003)04-0057-04访问控制是实现信息安全的一种重要手段,对访问控制技术的研究一直是国内外信息安全界的一个热点[1] 从20世纪70年代开始,先后提出了Bell Lapadula模型,HRU模型,Take Grant模型, Biba模型等众多访问控制模型 1992年,Ferraiolo 和Kuhn提出了基于角色的访问控制模型(role based access control,简称RBAC) 这些访问控制模型的共同点在于它们都是从系统的角度出发保护资源 它们的弱点在于都没有把操作主体执行操作时所处的环境考虑在内,且只要主体拥有对客体的访问权限,主体就可以无数次使用该权限,这样容易造成安全隐患 另外,它们在进行授权时,将权限提前授予,不符合 最小特权原则 在WBA中采用上述访问控制模型时,往往显得力不从心 目前大多数WBA所采用的访问控制机制主要是基于单个用户的,显然这些访问控制机制已经无法满足企业规模不断扩大的需要 即使在WBA中采用RBAC模型[2-4],为了实现最小特权原则,提高系统安全性,也需要频繁地切换角色,而且难以随执行的上下文环境实现对权限的动态控制,不能实现对用户行为的时间关联约束,也不能实现控制权安全一致的传递,因此必须探寻行之有效的解决办法 Thomas和Sandhu于1993年提出了基于任务的访问控制(task based access control,简称TBAC)[5] TBAC不从系统的角度而从应用和企业级的角度来考虑和解决安全访问控制问题,它面向任务 在TBAC中,主体所拥有的访问权限并不是静态的,而是随着所执行任务的上下文环境发生变化的,因此,TBAC模型的权限管理极其复杂为更好的适应企业级或更大型组织对WBA进行访问控制的安全需求,把用户对WBA的访问作为角色的任务执行请求,在WBA服务器端把需要进行访问控制的WBA根据具体的业务流程抽象为多个工作流,每个工作流由一个或多个任务组成 [7]这样对WBA的访问控制就转化为根据任务和角色进行Web访问控制 因此,笔者对TBAC模型[5,6]进行改进,引入了角色的概念,进而把TBAC 和RBAC结合起来,简化了对用户和访问权限的管理,克服了TBAC模型权限管理复杂的缺点,解决了RBAC不能对用户访问行为实现时间关联约束,不能保证控制权安全一致的传递的问题 [4]1 根据任务和角色进行Web访问控制TBAC适用于工作流环境,通过组成工作流的任务来实现对用户权限的动态管理 利用任务和角色进行Web访问控制是将角色的概念引入到TBAC模型中,每个角色具有一定的权限,用户通过成为某个角色而获得相应的权限,但角色与RBAC 模型中的角色的语义不同,在笔者采用的模型中,用户通过成为某个角色而拥有的权限在包含它的元授权步激活该角色之前并不能使用,当元授权步无效[收稿日期]2003-03-20[基金项目]国家自然科学基金资助项目(60273040)[作者简介]陈继明(1977-),男,江苏镇江人,硕士生,主要从事网络信息安全、CRM系统开发研究效时,角色所拥有的权限被冻结 而在RBAC 模型中,用户成为某个角色后就能够随时使用该角色所拥有的权限 由于对用户的权限是通过角色和任务来进行分配和管理的,因此它能够满足许多WBA 的访问控制要求 由于实现了用户与访问权限的逻辑分离,基于角色的策略极大地方便了权限管理,而且对实际应用环境的访问控制需求的描述更自然 该方法结合了RBAC 模型和TBAC 模型的优点,通过角色实现了用户与访问权限的逻辑分离,消除了用户变化对工作流程的影响,有利于工作流程的标准化并增强了可重用性 同时通过任务实现了对访问权限的动态控制,实现了对用户访问行为的时间关联约束,保证了控制权安全一致的传递 1 1 概 念[5]元授权步是指在一个工作流程中对处理对象的一次处理过程,是所能控制的最小单元 每个元授权步包含一个角色 角色是指一个组织或任务中的工作或位置,它代表了一种资格、权利和责任 角色用来实现用户和权限的逻辑隔离,即用户与角色相关联,角色与权限相关联,用户通过成为相应角色而获得相应权限 其中,角色所关联的用户集合称为受托人集,受托人集中的每个用户都可被授予元授权步 受托人集的成员被授予元授权步时拥有的访问许可称为角色许可集 当元授权步初始化后,一个来自受托人集中的成员所具有的角色将被激活,并授予元授权步,这个受托人称为元授权步的执行委托者,该执行委托者在执行元授权步的过程中所需许可的集合称为角色执行许可集 在笔者采用的方法中,一个元授权步的处理可以决定后续元授权步对处理对象的操作许可,这些许可称为激活许可集 角色执行许可集和激活许可集一起称为元授权步的保护态图1 元授权步中的受托人!角色!许可集关系F ig 1 Relation of trustee role permissons set inmeta author ization step每个授权步由一个或多个元授权步组成,这些元授权步在逻辑上存在依赖关系 授权步分为一般授权步和原子授权步 一般授权步内的元授权步依次执行,原子授权步内部的每个元授权步紧密联系,其中任何一个元授权步失败都会导致整个原子授权步的失败 任务是工作流程中的一个逻辑单元 它是一个可区分的动作,可能与多个角色相关,也可能包括几个子任务 授权步是任务在计算机中进行控制的一个实例 任务中的子任务对应于授权步中的元授权步 依赖是指元授权步之间或授权步之间的相互关系,包括顺序依赖、失败依赖、失败代理依赖、失败撤消依赖、分权依赖、分级分权代理依赖 工作流是指组织(如政府部门,企业等)内部各个任务的流动和处理方式,它可以用有向图来表示,图中的每个节点对应一个授权步,而图中的边表示授权步间的依赖关系 一个工作流的完整业务流程可以由多个任务构成 而每一个任务对应于一个授权步,每个授权步由特定的元授权步组成 授权步之间以及元授权步之间通过依赖关系联系在一起 1 2 Web 访问控制模型的形式化表示Web 访问控制模型形式化描述如下:(1)由工作流Wf ,授权步As ,元授权步mAs ,角色R ,用户U ,许可集P ,任务执行请求Ar 七部分组成(2)每个授权步As 由一个或多个元授权步mAs 组成,即A s ={m As 1,mAs 2,∀,mAs n },mAs 之间的关系为mAs #mAs 2D,D ={顺序依赖,失败依赖,分权依赖,分级分权代理依赖,失败代理依赖,失败撤消依赖}(3)每个Wf 由一系列As 组成,即Wf ={As 1,As 2,∀,As n },As 之间的关系为As #As 2D,D ={顺序依赖,失败依赖,分权依赖,分级分权代理依赖,失败代理依赖,失败撤消依赖};工作流可以表示为有向图Wf =(As ,E ),其中As 是节点,边E 表示As 之间的依赖关系(4)UA U #R ,UA 是用户到角色的多对多的关系(5)A s 与R 是1:n 关系,A s ∃R ,是从授权步到一个角色的映射,随时间变化而变化 U ∃R 是从U ={U 1,U 2, ,Un }选择一个执行委托者扮演角色的函数(6)As 与P 是1:n 关系,Initial(As ,R )∃P ,P ={p 1,p 2,∀,p n }为许可集,Initial 为角色执行许可集的激活函数;Revoke(As ,R ,P 1)∃P 2,P 1 2P,P 2=P P 1,Revoke 为权限回收函数授权用五元组(R ,O ,P ,L ,mAs )来表示 其中R 表示角色,O 表示客体(指需要进行访问控制的对象),P 表示权限,L 表示元授权步mA s 的存活期限 P 是元授权步mAs 所激活的权限 在元授权58 江苏大学学报(自然科学版) 第24卷步mAs被触发之前,它的保护态是无效的,其中包含的权限不可使用 当元授权步mA s被触发时,与其对应的角色所拥有的许可集中的权限被激活,同时它的存活期开始倒记时,在元授权步存活期间,五元组(R,O,P,L,mAs)有效 当生命期终止,即元授权步mAs无效时,五元组(R,O,P,L,mAs)无效,角色所拥有的权限被禁止访问控制策略包含在As As,mAs mAs,A s R, U R,A s P关系中 As As和mAs mA s的关系决定了一个工作流的执行过程,As R,U R和As P组合决定了一个授权步的运行 它们的关系由WBA的系统管理员根据需要保护的WBA应用的具体业务流程和系统访问控制策略进行直接管理通过基于任务和角色的动态权限管理,笔者的方法支持最小特权原则和职责分离原则2 在Web上的实现在实现Web访问控制模型时,采用了与文献[4]相同的安全cookies机制 这主要是出于以下几个原因:%在现有的Web浏览器和Web服务器中已经广泛采用了cookies技术保持Web状态信息 对其进行安全增强比较直接,代价较小;&HTT P协议是一个无状态的协议,cookies技术能够适应这种情况;∋更主要的是因为笔者的方法与RBAC的主要差别是在Web服务器端对通过认证的角色采用了不同的访问控制策略,而客户端尽管角色的含义在两个访问控制模型中不同,但是在安全cookies的构成和表达形式是一样的 因此,笔者希望通过采用类似的实现机制来说明Web访问控制模型在实际应用中实现的代价和难度也并不比RBAC的Web访问控制模型大,具有更好的实用价值2 1 cookiescookies是一种为Web所广泛采用的技术,在cookies中包含关于用户信息的字符串,当用户通过浏览器访问一个使用cookies的Web站点时,含有用户相关信息的cookies就会被送到用户的内存中,当浏览器关闭之后,这些信息就会被存到用户的硬盘中去 此后,如果该用户再次访问这个Web站点时,Web服务器就可以从用户硬盘里存放cookies内容的文件中读取相应cookies中的内容2 2 安全cookies的实现常规cookies没有考虑安全问题,必须对它们进行安全改造,使它们变成安全cookies,这些改造后的cookies必须提供身份认证、完整性和保密性服务 身份认证服务用于证实cookies拥有者的身份;完整性服务用于保护cookies免受非授权用户的篡改;保密性服务用于防止信息的泄漏 实际应用中到底使用哪种cookies以及其内容的确定要根据具体的使用环境而定 但是,不管是哪种应用,至少要有一个认证cookie以及一个提供完整性服务的cookie,因为只有这样才能构成基本的安全服务[4] 图2是用于对Web实现访问控制的一组安全cookies,它们形式上与文献[4]中的安全cookies相同 其中Name Cookie包含用户名 Role Cookie 包含用户的角色信息Name Co okie Rol e Cooki e Life Coo kie Pswd Cookie IP Cookie Seal Co okieDomain Flag Pat h Cookie Name Coo kie value Secure Ex pire Virgov go v t rue Name Zhang San f a lse01 07 02 Virgov go v t rue Role Clerk f a lse01 07 02 Virgov go v t rue Life Co okie01 07 02f a lse01 07 02 Virgov go v t rue Rswd Cookie Encrypt Pswd f a lse01 07 02 Virgov go v t rue IP Cookie202 119 36 23f a lse01 07 02 Virgov go v t rue Se al Cookie Di g i t al Sign f a lse01 07 02图2 安全cookiesFig 2 Secure coo kies需要说明的是,尽管Role Cookie的内容在笔者提出的方法和文献[4]提出的RBAC中是一样的,但是它的语义在两个模型中是完全不同的,文中提到的角色在包含它的元授权步激活之前是无效的,角色不是实现访问控制的主体,而是通过包含角色的元授权步达到访问控制的目的 而文献[4]中,用户一旦获得某个角色,就能够任意使用角色所拥有的权限,角色是访问控制的主体2 3 通过安全cookies实现Web访问控制模型图3是在Web上实现访问控制的示意图 根据组织结构和工作流程,可以把它的Web应用服务器上所提供的需要进行访问控制的多个WBA组织59第4期 陈继明等:根据任务和角色进行Web访问控制成多个工作流 根据部门设置,可以把一个部门作为一个域,每个域设置一个用户 角色服务器 用户 角色服务器中存放着所在域的用户角色信息 只有成功通过对用户身份的认证,用户才能够收到从用户 角色服务器返回的为其分配的角色信息(也就是图2的6个安全cookies) 此后,当用户通过浏览器访问Web 服务器时,Web 服务器通过安全cookies 来验证用户,并根据用户所希望访问的工作流的状态来决定是否允许用户根据其角色来执行交互图3 在W eb 上访问控制的实现F ig 3 Access control for Web需要再次强调的是,图3中的角色和文献[4]中的角色在语义上是不同的 此外,在Web 访问控制系统的具体实现细节上,与文献[4]的主要区别在WBA 服务器端 首先,在WBA 服务器取出角色后实行的是基于角色和任务,而不是RBAC 其次,对于WBA 服务器上需要进行访问控制的WBA,在本文中引入了工作流的概念,对其进行整体刻画,并对任务进行组织,而任务则用来实现对权限的动态访问控制 而在RBAC 中只是考虑了资源保护问题3 结 论处于网络环境中的Web 应用的访问者往往种类繁多,数量庞大,并且动态变化,使得传统的自主访问控制、强制访问控制和基于角色的访问控制方法难以对Web 进行高效的动态访问控制 在文献[3~6]的基础上,将TBAC 模型和RBAC 模型相结合,在TBAC 模型中引入了角色的概念,可以同时利用角色和任务进行Web 访问控制 由于引入了角色的概念,有利于Web 访问控制模型对实际应用环境的访问控制需求的描述,可以根据人员的职责确定角色,降低了系统管理员的工作难度 把用户对WBA 的访问作为角色的任务执行请求,而在WBA 服务器端则把需要进行访问控制的多个WBA 抽象为多个对应的工作流,这些工作流由一个或多个任务组成 这样对WBA 的访问控制问题就转化为基于任务和角色的访问控制[参 考 文 献][1] Rohit K W eb Security :A M atter of T rust[R] Sebastopol:O (Reilly &Associates,Inc U S A,1997 [2] Ferraiolo D F ,Barkley J F ,K uhn D R A Role BasedA ccess Contro l Mo del and Reference I mplementation within a Corporate Intranet [J] ACM T ransactions of Information and System Secur ity,1999,2(1):34-64[3] Sandhu R ,Cony ne E J ,L feinstein H ,Youman C ERole Based A ccess Cont rol M odels[J] I EEE Computer,1996,29(2):38-47[4] Park Joon S,Sandhu R,Ahn Gail Joon Role Based Access Control on the Web[J] ACM T r ansact ions on Infor mation and System Security,2001,4(1):67-72 [5] 邓集波,洪 帆 基于任务的访问控制模型[J] 软件学报,2003,14(1):76-82[6] K ristol D,M ontulli L Http State M anagement M echanism[R ] R FC 2965,N etw ork Wor king G roup,I nter net Eng ineering T ask Force,2000[7] 孙 健 Domino No tes 安全机制及网状安全设计研究[J] 江苏大学学报(自然科学版),2001,22(3):71-74T ask and Role Based Control Model for Web AccessC H EN Ji m ing ,S ONG Shun lin(School of Computer Science and Telecommunications,Jiangsu University,Zh enjiang,212013,China)Abstract :As an effective measure to achieve information security,access control is important in WBA secu rity Current approaches to access control for WBA are mostly based on individual users and they do not fit to enterprise wide systems A new access control m echanism is presented T he new mothod can meet the need in managing and enforcing the strong and efficient access control in large scale Web environments The im plement ation of new model on the Web is also illustratedKey words :Web security;access control;role;task(责任编辑 朱银昌)60 江苏大学学报(自然科学版) 第24卷。
附录A：英文原文Role-Based Access Control for the WebJohn F. Barkley, D. Richard Kuhn, Lynne S. Rosenthal, Mark W. Skall, and AnthonyV. Cincotta,National Institute of Standards and Technology Gaithersburg, Maryland 20899ABSTRACTEstablishing and maintaining a presence on the World Wide Web (Web), once a sideline for U.S. industry, has become a key strategic aspect of marketing and sales. Many companies have demonstrated that a well designed Web site can have a positive effect on their profitability. Enabling customers to answer their own questions by clicking their way through Web pages, instead of dealing with operators and voice response systems, increases the efficiency of the customer interface.One of the most challenging problems in managing large networked systems is the complexity of security administration. This is particularly true for organizations that are attempting to manage security in distributed multimedia environments such as those using World Wide Web services. Today, security administration is costly and prone to error because administrators usually specify access control lists for each user on the system individually.Role-based access control (RBAC) is a technology that is attracting increasing attention, particularly for commercial applications, because of its potential for reducing the complexity and cost of security administration in large networked applications. The concept and design of RBAC is perfectly suited for use on both intranets and internets. It provides a secure and effective way to manage access to an organization’s Web information. This paper describes a research effort to develop RBAC on the Web. The security and software components that provide RBAC fornetworked servers using Web protocols have been implemented and are described in this paper. The RBAC components can be linked with commercially available web servers, and require no modification of the server software.IntroductionEstablishing and maintaining a presence on the World Wide Web (Web), once a sideline for U.S. industry, has become a key strategic aspect of marketing and sales. Many companies have demonstrated that a well-designed Web site can have a positive effect on their profitability. Enabling customers to answer their own questions by clicking their way through Web pages, instead of dealing with operators and voice response systems, increases the efficiency of the customer interface. Companies are seizing the Web as a swift way to streamline - even transform their organizations.More recently companies have begun using web technology to service the public as well as private and internal clients. Web sites are set up to segregate some information from the general public, providing it to only selected or "private" clients. Typically, public internet is cordoned off from the general public by having user accounts and passwords. Additionally, Web sites are now running inside the company often created for and by employees. These internal private nets or "intranets" use the infrastructure and standards of the Internet and the World Wide Web but are cordoned off from the public Internet through firewalls.The Web can be used as an inexpensive yet powerful alternative to other forms of communications. A plethora of corporate information (e.g., procedures, training materials, directories, forms) can be converted to electronic form and made available via the Web. With a single source for these materials the cost of maintenance is significantly reduced, while greatly simplifying the task of ensuring currency. Thus an objective of enterprise computing, creation of a company wide system irrespective of the underlying information technology infrastructure can be fulfilled.Although the internet and intranets can offer great benefits to a company or government agency, security threats remain. To date net enthusiasts tend to focus on how to link people and businesses, not on using the network as a way to run and manage businesses securely. Althoughexisting Web servers can effectively provide all or nothing access to a particular Web site and a number of popular Web servers can even provide fairly fine grained access control, they provide very primitive tools to administer these controls from the perspective of a single enterprise.This paper describes the benefits of RBAC and an implementation of RBAC on the Web (RBAC/Web), and in particular as RBAC applies to an intranet computing environment. This will provide Web administrators with a capability for the first time to centrally administer and regulate user access to information in a manner that is consistent with the current set of laws, regulations, and practices that face their business today. Although this paper focuses on intranets, the benefits, concepts and implementation of RBAC/Web are also applicable to a company’s internet environment where restrictive access to information is desired. RBAC DescriptionRole-based access control (RBAC) [1], [2], [3], [4], [5] is an alternative to traditional discretionary (DAC) and mandatory access control (MAC) policies that is attracting increasing attention [6], particularly for commercial applications. The principal motivation behind RBAC is the desire to specify and enforce enterprise-specific security policies in a way that maps naturally to an organization's structure. Traditionally, managing security has required mapping an organization's security policy to a relatively low-level set of controls, typically access control lists.With RBAC, security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, where roles are based on the user's job responsibilities and competencies in the organization. Each role is assigned one or more privileges (e.g., information access, deletion, creation), see Figure 1. It is a user's membership into roles that determine the privileges the user is permitted to perform. Security administration with RBAC consists of determining the operations that must be executed by persons in particular jobs, and assigning employees to the proper roles.The RBAC framework provides for mutually exclusive roles as well as roles having overlapping responsibilities and privileges. For example, some general operations may be allowed by all employees, while otheroperations may be specific to a role. Role hierarchies are a natural way of organizing roles within an organization and defining the relationship and attributes of the roles. Complexities introduced by mutually exclusive roles or role hierarchies as well as regulating who can perform what actions, when, from where, in what order, and in some cases under what relational circumstances, is all handled by the RBAC software. Separation of DutyRBAC mechanisms can be used by a system administrator in enforcing a policy of separation of duties. Separation of duties is considered valuable in deterring fraud since fraud can occur if an opportunity exists for collaboration between various job related capabilities. Separation of duty requires that for particular sets of transactions, no single individual be allowed to execute all transactions within the set. The most commonly used examples are the separate transactions needed to initiate a payment and to authorize a payment. No single individual should be capable of executing both transactions. The system administrator can control access at a level of abstraction that is natural to the way that enterprises typically conduct business. This is achieved by statically and dynamically regulating users' actions through the establishment and definition of roles, role hierarchies, relationships, and constraints.We define static separation of duty to mean that roles which have been specified as mutually exclusive cannot both be included in a user's set of authorized roles. With dynamic separation of duty, users may be authorized for two roles that are mutually exclusive, but cannot have both roles active at the same time. In other words, static separation of duty enforces the mutual exclusion rule at the time an administrator sets up role authorizations, while dynamic separation of duty enforces the rule at the time a user selects roles for a session.Role Administration and VisualizationThe roles are established, manipulated and viewed using the RBAC/Web Admin tool. The Admin tool allows system administrators to create and define roles, role hierarchies, relationships and constraints. Once theRBAC framework is established for the organization, the principal administrative actions are the granting and revoking of users into and out of roles as job assignments dictate. These maintenance tasks are easily performed using the Admin tool.Additionally, the Admin tool is being enhanced to utilize the Virtual Reality Modeling Language (VRML, pronounced 'vermal'). VRML is an interactive, inter-networked, 3D graphics language for the Web. It is used to represent graphics, test, sound, and links to other content as either a static or dynamic picture on the Web. The inclusion of VRML into RBAC lets system administrators use an interactive computer model to check and validate the role structure, relationship, and privileges. Being able to view and interact with complex models, allows the administrator to identify conflicts, eradicate flaws and improve the implementation early in the RBAC setup.The VRML component will enable authorized users to navigate the RBAC database, finding and linking roles, and displaying attributes and graphics associated with those roles. By presenting a 3D model of established roles, the user can easily see which roles are mutually exclusive as well as the hierarchical structure of related roles and conflicts between roles (see Figure 2). VRML's navigational controls allows the user to interactively 'walk-through' and manipulate the view perspective of the 3D model, known as a scene graph. For example, the scene graph can be rotated to show the 'backside' of the graph where role relationships may have been obscured when viewed as a 'flat', 2D graph. To improve readability, clarity and flexibility, the role hierarchy is organized into layers, where each layer contains another level of detail. By 'clicking' on a role, the role opens to reveal the next layer of related roles or information about the role, e.g., the privileges associated with that role or a user membership list.RBAC ExampleConsider the branch office of a bank. In this environment, there are roles such as branch manager, teller, and account representative, as illustrated in Figure 2.The graph structure shows role hierarchy. The role financial_advisor inherits the role account_rep. An individual authorized for the rolefinancial_advisor is permitted to perform all of the operations permitted to an individual authorized for the role account_rep. Thus, an individual in the role of financial_advisor is able to create and remove accounts. Because account representatives, branch managers, internal auditors, and tellers are all employees of the bank, their corresponding roles inherit the employee role.In Figure 2, the role account_rep is highlighted, appearing as a dark sphere, in order to show the other role relationships for account_rep. The roles teller and account_holder are shown as yellow rectangular solids to indicate that these roles have a "Dynamic Separation of Duties" (DSD) relationship with the role account_rep. This relationship is a conflict in interest relationship indicating that an individual acting in the role of account_rep cannot also be acting in either of the roles of account_holder or teller. The policy of the bank is that an account representative, an employee of the bank, can have an account in the bank but such an individual may not simultaneously process their personal account while processing accounts of others. Likewise, because a teller has an open cash drawer that must balance when closed, an individual acting in the role of account_rep and sitting at a desk away from a teller's window is not permitted to simultaneously act in the role of teller even if authorized for that role.The role internal_auditor is shown in a red hexahedron to indicate that this role has a "Static Separation of Duties" (SSD) relationship with the role account_rep. The SSD relationship is also a conflict of interest relationship like the DSD relationship but much stronger. If two roles have a DSD relationship, then they may both be authorized for an individual but that individual may not act in both roles simultaneously. If two roles have a SSD relationship, then they may not even be authorized for the same individual. In this example, the policy of the bank is that there is a fundamental conflict of interest between the roles of internal_auditor and account_rep. Thus, these two roles may never be authorized for the same individual.The new version of the Admin tool using VRML will allow us to represent conflicts of interest and other relationships in a more natural way and view the scene from an infinite number of viewpoints. VRML allows complex3D objects to be created for this purpose. The user can 'enter' a selected role and explore several levels of detail (i.e., information) associated with that role. In addition, the sound capabilities of VRML can be utilized to give audio warnings when roles are used which cause conflicts of interest or other problems, or when improper procedures are used. RBAC for World Wide Web ApplicationsRole Based Access Control (RBAC) for the World Wide Web (RBAC/Web) is an implementation of RBAC for use by World Wide Web (Web) servers. Because RBAC/Web places no requirements on a browser, any browser that can be used with a particular Web server can be used with that server enhanced with RBAC/Web. RBAC/Web is implemented for both UNIX (e.g., for Netscape, NCSA, CERN, or Apache servers) and Windows NT (e.g., for Internet Information Server, WebSite, or Purveyor) environments.Components of RBAC/Web are shown in Table 1. RBAC/Web for UNIX uses all of the components in Table 1. Because built-in NT security mechanisms are closely compatible with RBAC, the NT version uses only the Database, Session Manager, and Admin Tool components. RBAC/Web for NT requires no modification of Web server internals or access to source code. With RBAC/Web for UNIX, there are two ways to use RBAC/Web with a UNIX Web server.The simplest way is by means of the RBAC/Web CGI. The RBAC/Web CGI can be used with any existing UNIX server without modifying its source code. RBAC URLs are passed through the Web server and processed by the RBAC/Web CGI. RBAC/Web configuration files map URLs to file names, while providing access control based on the user's roles. Installation of the RBAC/Web CGI is similar to the installation of the Web server.附录B：中文翻译Web环境下基于角色的访问控制John F. Barkley, D. Richard Kuhn, Lynne S. Rosenthal, Mark W. Skall, 和Anthony V. Cincotta,国家研究院所定规则及盖瑟斯堡技术，马里兰20899摘要建立和维持一个万维网（Web），它作为美国工业的一种附属形式，已经成为了买卖和销售战略中的重点。
