CoCoMan Technology

        public override SiteMapNode BuildSiteMap()
        {
            //if (root != null) return root;

It works as you expected, but this is extremely inefficient; "as multiple concurrent page requests can result indirectly in multiple calls to load site map information" (i.e. to run BuildSiteMap) - the MSDN explains. Set a breakpoint inside BuildSiteMap function, you will find what MSDN said is true. Loading one single page in the web project will call BuildSiteMap many times. Alright, if that is the case, the only thing we need is a session variable to make sure every users only run the BuildSiteMap once.  The final code:

public class DynamicSiteMapProvider : StaticSiteMapProvider {
//a kindly reminder that all private fields inside this class will be persistently available during the lifetime
//please remember to do extra init with these fields in the BuildSiteMap method

 The solution above is trivial, a bit informal yet feasible. Actually SiteMapProvider has a property "securityTrimmingEnabled" to specify if the Provider equip with role. In that case, you need to override the "IsAccessibleToUser" method. More information please visit:
http://fredrik.nsquared2.com/viewpost.aspx?PostID=272&showfeedback=true
http://blogs.msdn.com/dannychen/archive/2006/03/16/553005.aspx

In order to finally solved the problem with a formal solution, we need to work with the ASP.NET 2.0 Role Manager, and Membership Provider if you want to.

First of all, define a series of roles that what menu/urls in your project they can access to, then modify your data structure to place your role information. E.g. add a "roles" field in your sitemap database table if you are using database storage. Using the following format if you are using xml file to store the sitemap:

 <siteMapNode title="Home" description="Home" url="~/default.aspx" roles="*">
  <siteMapNode title="menu 1" description="" roles="Admin,User" >
   <siteMapNode  roles="Admin" title="Admin Item" description="" url="~/admin.aspx" />
   <siteMapNode roles="User" title="User Item" description="" url="~/user.aspx" />
  </siteMapNode>
 </siteMapNode>

the menu will look like:
Home  (can be accessed by all users)
  - menu 1 (can be accessed by Admin and User
    - Admin Item (Can be accessed by Admin only)
    - User Item (can be accessed by User only)

*note: if you are not going to write your own xml SiteMapProvider, the ASP.NET 2.0 already has a simple one for you - System.Web.XmlSiteMapProvider. BUT, please be aware that the XmlSiteMapProvider only supports security trimming on menu/node who has child-node. In this case, if using XmlSiteMapProvider, the security trimming setting only works for "menu 1". In other word, "Admin Item" and "User Item" will be accessed by both "Admin" and "User" as "menu 1" specify.

Then, modify the Login.aspx:

....After verifying the login username and password
.... and get the roleName of login user
//init the roles, clean login user's role
string[] allRoles={"Admin","User"};
foreach (string role in allRoles)
{
    if (!Roles.RoleExists(role)) Roles.CreateRole(role);
    if (Roles.IsUserInRole(user, role)) Roles.RemoveUserFromRole(user, role)
}
//add the user to the role s/he belongs to
Roles.AddUserToRole(user, roleName);

Finally, modify the BuildSiteMap method of  SiteMapProvider, and override the IsAccessibleToUser. The main difference from previous version is that in the BuildSiteMap function, instead of loading "per-user" menu data, we just load a full set of menu, leave the IsAccessibleToUser to determine if a node should be shown or access to. 

public override SiteMapNode BuildSiteMap()
        {
            if (root != null) return root;

Last step, don't forget to set SecurityTrimmingEnabled to true in web.config file.

    <siteMap defaultProvider="DynamicSiteMapProvider" enabled="true">
      <providers>
        <add name="DynamicSiteMapProvider" type="myProject.DynamicSiteMapProvider"  securityTrimmingEnabled="true" />
      </providers>
    </siteMap>

• 如果对ASP.NET的缓存Cache理解有困难，请想象它是一个会自动过期的Application对象
• 一个缓存对象的失效可以依赖于时间（超过一定时间）、文件（文件被修改、删除等）或者其他缓存对象，甚至可依赖于数据库内容被修改。异常的失效包括IIS被重启、应用程序异常终止、内存不足等。
• HttpRuntime.Cache = Page.Cache = HttpContext.Current.Cache 获得的是同一个对象
• 通常被缓存的对象按被缓存的时间划分可分为：
  • 超长期。通常是应用程序一开始就被缓存，到结束时才被释放，例如程序配置对象
  • 普通。通常是几分钟至几十分钟过期的对象，大部分的缓存都是这一类型
  • 超短期。这类缓存在页面被请求的时候建立，到页面请求结束时被销毁。将缓存对象存放于HttpContext.Current.Items中，每次请求结束时会被系统自动清除。通常用在服务器控件上，比如一个页面包含10个相同的服务器控件A。假设A需要到数据库中读一堆相同的数据，如果使用缓存，只需要访问数据库1次，否则需要访问数据库10次。由此可以展开联想，不同的控件如果操作相同的内容，也可以使用缓存。
• 缓存不可过度使用，通常以下的数据是很好的缓存对象
  • 可以被重复多次使用的对象、计算结果
  • 数据是通用的，而不是属于特定用户、页面的
  • 如果是特定用户的数据，但寿命较长的，也可考虑缓存，但比较少使用

参考资料：http://msdn.microsoft.com/zh-cn/magazine/cc163854(en-us).aspx

• Start -> Settings -> Control Panel
• then open the Administrator tools, double click to run Microsoft .NET Framework 2.0 Configuration
• expend My Computer, select Run Time Security Policy, finally click the task Adjust Zone Security on the right
• if you have enough Windows privilege, the option "make change to this computer" should be selected by default, otherwise please contact your system administrator to perform this adjustment
• change the security level of  Local Intranet to Full Trust
• don't forget the last step, to close visual studio and start again, otherwise the adjustment will not be effected

Good luck!