This paper presents a Criterion-Based Role-Based Multilayer Access Control model in which a number of security criterion expressions are embedded into every object to specify the security attributes of its sub objects. Meanwhile, a security criterion subset is combined with each operation to reflect the relevant keys of the embedded security criterion expressions in the corresponding object, and another security criterion subset is associated with each user to specify the user?s security features. The desired multilayer access control is achieved by evaluating the embedded security criterion expressions by using the common elements of the security criterion subsets associated with the related operation and the related user. The proposed model, which is an extension of traditional Role-Based Access Control (RBAC) model, efficiently supports both the multilayer access control and non-multilayer access control. In addition to the advantages of traditional RBAC, the model is simple in logic and efficient in performance.