Role optimization method and apparatus in RBAC permission system

Abstract

The embodiment of the present application provides a role optimization method and device in the RBAC authority system. The method includes: calculating the similarity between any two roles in the specified roles; taking one of the specified roles as a starting point, and according to the traversal condition that the similarity between the roles is the largest, in the specified role. traversing the graph; determining similar roles according to the traversal results; determining an optimized role for the similar roles according to a set of identical permissions and a set of different permissions among the similar roles. The embodiment of the present application makes the set of permissions among the roles as completely independent as possible, and together represent a business meaning, thereby reducing the occurrence of the same or overlapping permissions in different roles, and further reducing the unreasonable assignment of roles to users. System security risks.

Description

technical field [0001] The present application relates to the technical field of access control, in particular to a role optimization method in the RBAC authority system and a role optimization device in the RBAC authority system. Background technique [0002] Permissions are the permission conditions required to operate one or a group of resources. Users are the owners of permissions. When users access a certain resource, they need to have corresponding permissions. Wherein, a resource is an object accessed by a user, and may be a webpage (URL resource), sensitive information (data resource), and the like. [0003] In the RBAC (Role-Based Access Control, role-based access control) permission system, permissions are associated with roles, and roles are the allocation unit and carrier of permissions. A role contains one or more permissions, which is a collection of certain permissions , By assigning a certain role to the user, the user can obtain the authority of the role, w...

AI Technical Summary

Problems solved by technology

[0004] However, as time goes by, there will be more and more resources that need to be controlled based on permissions, more and more corresponding permissions, and more and more roles. It is very easy for different roles to have the same or overlapping permissions. Happening

For example, when a new user requests access to a web site, the authority administrator may find multiple roles with the authority at the same time. In this case, it is very likely that the user will be assigned a role with a large authority set role, which increases the user's access to the system and gives the user the opportunity to perform unauthorized operations, which in turn brings security risks to the system

Images