Research And Application Of The Access Control Model Based On Role And Attribute

With the development of computer and network technology, people’s work andlife are closely related with the various information systems, but network andinformation security are also facing serious threats. Among the many securitytechnologies and services, access control is an important means of informationsystems to ensure the security of the system and is an essential part of all informationsystem.First of all, this paper reviews the history and current situation of thedevelopment and research of access control technology，analyzes the changingrequirements about secure access control in the complex information systems,describes implementation mechanisms, security policies and related models of thegeneral access control technology, especially discusses role based access control(RBAC) and attribute based access control (ABAC). And then, based on the study ofRBAC and ABAC, a complex model R&ABAC which is short for role and attributebased access control is constructed, describes the access strategy of the model withthe aid of formal methods. This model use role authorization and attribute mappingmethod to achieve the complex access control policies, and is can satisfy the typicalsystem security principle. Through comparative analysis among the models,R&ABAC is fine-grained, flexible, scalable and easy for access control in aninformation system. At last, the R&ABAC is analyzed and implemented in the tradingplatform of public resources by requirements analysis and system design.Currently, the trading platform of public resources has been formally launched,which is running in stable condition and can well meet the actual access controlrequirements.