A New Design Scheme of Role-Based Access Control Based on PKI

Identification and authorization are the two important problems among the intractable issues of network security. In this thesis, we first discuss the advantages and disadvantages of several traditional ways in identification and authorization including Kerberos, SSL, DAC, MAC, RBAC and PKI/PMI. Because of the inherent weakness of DAC and MAC, and the complexity of PMI, we propose a new system which combines role-based access control with PKI. It implements the process of identifying and privilege delegation as a whole. The model of RBAC based on PKI can ensure the security of both identification and authorization of the protected system and maximize the flexibility for users' maintenance. The particular process of identification and authorization has been given in the thesis. At last, we analyze the security of the system and also point out some existing threats the new framework has to face to