摘要
With increasingly development of web technologies, complex authorization policies need to be securely implemented in business process, more and more sensitive data should be managed under confidential environment. There are lots of researches on how to protect data with more secure mechanisms, for example, Public Key Infrastructure, Privilege Management Infrastructure, and Role Based Access Control is the model of ¡°strategies neutral? yet it has not given a specific definition on permission. This article emphasizes web resource, proposes a Hierarchical Permission Based Access Control model, divides these resources into modules, menus, pages and functions, analyzes the secure access control of the resource, and discusses several ways of authorization, revocation and checking access. So this model meets the need of web access control, and is proved that the construction can manage enterprise-level's access control with security, flexibility and robustness.