A Study of Role-Based Access Control for Web Database

• Main Authors: CHAN-SHENG CHUANG, 莊展昇
• Other Authors: Chung Shyan Liu
• Format: Others
• Language: zh-TW
• Published: 2008
• Online Access: http://ndltd.ncl.edu.tw/handle/44564716359265247065

碩士 === 中原大學 === 資訊工程研究所 === 96 === SQL injection is a common type of database attacks in a web-based system. Parameterized view is an approach to SQL injection defense by transferring a user’s identification to databases to provide access control. But in the original form of parameterized view method, a view and an associated key were created for each user. In this thesis, we proposed to add role-based access control mechanism to the parameterized view. A view is created for each role, but not for each user, to reduce the number of views needed to be created. The identity of a user is mapped to a role, which is then used to create a view for that role. This view can thus be accessed by users of that role. An example system is also implemented for illustration.