提出了一个基于角色的工作流访问控制模型WACBR(Workflow access control model based on role)。WACBR中加入了“任务”的概念,任务是工作流系统执行时的最小工作单元。由于工作流中的任务分别对用户和权限进行授权,采用两种不同粒度...提出了一个基于角色的工作流访问控制模型WACBR(Workflow access control model based on role)。WACBR中加入了“任务”的概念,任务是工作流系统执行时的最小工作单元。由于工作流中的任务分别对用户和权限进行授权,采用两种不同粒度的角色分别作为这两种授权的中介。展开更多
基于角色的访问控制(role based access control,RBAC)是软件系统中常用的授权机制,而工作流引擎中的核心授权单位是任务,使得RBAC难以应用在工作流系统中。文中在RBAC思想的基础上,通过对工作流资源边界的确立,将角色与工作流中的任务...基于角色的访问控制(role based access control,RBAC)是软件系统中常用的授权机制,而工作流引擎中的核心授权单位是任务,使得RBAC难以应用在工作流系统中。文中在RBAC思想的基础上,通过对工作流资源边界的确立,将角色与工作流中的任务相关联来进行资源的访问控制与授权,很好地将RBAC融合进工作流,有效地避免了工作流建立自成体系的权限控制而增加系统复杂性,让同一目标对象的授权在工作流引擎内外得到统一。同时,对业务流程建模与标注(business process model and notation,BPMN)的元模型进行安全约束的扩展,以便于在流程图中准确地表达基于角色和任务的安全约束需求,为业务流程的表示与执行提供了良好的支持;最后,将这种扩展应用在了四川省某电力公司的合同与督查管理系统中,并对其具体业务流程的应用进行分析与验证。展开更多
In the context of workflow systems, security-relevant aspect is related to the assignment of activities to (human or automated) agents. This paper intends to cast light on the management of project-oriented workflow. ...In the context of workflow systems, security-relevant aspect is related to the assignment of activities to (human or automated) agents. This paper intends to cast light on the management of project-oriented workflow. A comprehensive authorization model is proposed from the perspective of project management. In this model, the concept of activity decomposition and team is introduced, which improves the security of conventional role-based access control. Furthermore, policy is provided to define the static and dynamic constraints such as Separation of Duty (SoD). Validity of constraints is proposed to provide a fine-grained assignment, which improves the performance of policy management. The model is applicable not only to project-oriented workflow applications but also to other teamwork environments such as virtual enterprise.展开更多
The specification of authorization policies in access control models proposed so far cannot satisfy the requirements in workflow management systems(WFMSs).Furthermore,existing approaches have not provided effective co...The specification of authorization policies in access control models proposed so far cannot satisfy the requirements in workflow management systems(WFMSs).Furthermore,existing approaches have not provided effective conflict detection and resolution methods to maintain the consistency of authorization polices in WFMSs.To address these concerns,we propose the definition of authorization policies in which context constraints are considered and the complicated requirements in WFMSs can be satisfied.Based on the definition,we put forward static and dynamic conflict detection methods for authorization policies.By defining two new concepts,the precedence establishment rule and the conflict resolution policy,we provide a flexible approach to resolving conflicts.展开更多
文摘提出了一个基于角色的工作流访问控制模型WACBR(Workflow access control model based on role)。WACBR中加入了“任务”的概念,任务是工作流系统执行时的最小工作单元。由于工作流中的任务分别对用户和权限进行授权,采用两种不同粒度的角色分别作为这两种授权的中介。
文摘基于角色的访问控制(role based access control,RBAC)是软件系统中常用的授权机制,而工作流引擎中的核心授权单位是任务,使得RBAC难以应用在工作流系统中。文中在RBAC思想的基础上,通过对工作流资源边界的确立,将角色与工作流中的任务相关联来进行资源的访问控制与授权,很好地将RBAC融合进工作流,有效地避免了工作流建立自成体系的权限控制而增加系统复杂性,让同一目标对象的授权在工作流引擎内外得到统一。同时,对业务流程建模与标注(business process model and notation,BPMN)的元模型进行安全约束的扩展,以便于在流程图中准确地表达基于角色和任务的安全约束需求,为业务流程的表示与执行提供了良好的支持;最后,将这种扩展应用在了四川省某电力公司的合同与督查管理系统中,并对其具体业务流程的应用进行分析与验证。
文摘In the context of workflow systems, security-relevant aspect is related to the assignment of activities to (human or automated) agents. This paper intends to cast light on the management of project-oriented workflow. A comprehensive authorization model is proposed from the perspective of project management. In this model, the concept of activity decomposition and team is introduced, which improves the security of conventional role-based access control. Furthermore, policy is provided to define the static and dynamic constraints such as Separation of Duty (SoD). Validity of constraints is proposed to provide a fine-grained assignment, which improves the performance of policy management. The model is applicable not only to project-oriented workflow applications but also to other teamwork environments such as virtual enterprise.
基金supported by the National Natural Science Foundation of China (Nos.50705084 and 60473129)the Science and Technology Plan of Zhejiang Province,China (No.2007C13018)
文摘The specification of authorization policies in access control models proposed so far cannot satisfy the requirements in workflow management systems(WFMSs).Furthermore,existing approaches have not provided effective conflict detection and resolution methods to maintain the consistency of authorization polices in WFMSs.To address these concerns,we propose the definition of authorization policies in which context constraints are considered and the complicated requirements in WFMSs can be satisfied.Based on the definition,we put forward static and dynamic conflict detection methods for authorization policies.By defining two new concepts,the precedence establishment rule and the conflict resolution policy,we provide a flexible approach to resolving conflicts.
