In order to manage the privileges in multi application layers system and make use of the advantage of RBAC in security management, Multi-RBAC, a RBAC model that can be applied in all application-layers was presented. It was applied to all application-layers of system to protect the resources in different layers. Since the roles were defined by the resource privilege in different layers, the Multi RBAC made the classifying of roles more reasonable, the granularity less and the realization of least-privilege principle easier. Furthermore, all requirements of security can be satisfied with the help of other advanced RBAC model. In application, a security management system of CIMS was developed and applied successfully, which showed that the model is feasible.
