面向工作流系统的柔性策略访问控制模型  

Flexible policy access control model for workflow systems

作　　者：马晨华[1] 陆国栋[1] 裘炅[2] 

机构地区：[1]浙江大学工程与计算机图形学研究所,浙江杭州310027 [2]杭州电子科技大学计算机学院,浙江杭州310018

出　　处：《浙江大学学报（工学版）》2008年第12期2112-2120,共9页Journal of Zhejiang University：Engineering Science

基　　金：浙江省优先主题重点社会发展资助项目(2008C13G2010039);国家自然科学基金资助项目(60473129,50705084);浙江省重大科技专项资助项目(2007C13018);高等学校博士学科点专项科研基金资助项目(20060335118)

摘　　要：针对现有的访问控制模型应用于工作流系统时的不足,提出了一个面向工作流的柔性策略访问控制模型.该模型通过引入授权许可的概念,定义了各任务执行期间各角色可被授予的权限及相应的情景约束,实现了工作流中的动态访问控制和灵活的授权策略定义.为了描述工作流系统中的复杂授权规则,模型扩展了一种与授权许可相关的约束,并提供了有效的授权约束冲突检测与消解方法.分析表明模型具有良好的安全性与实用性,能较好地满足工作流系统对访问控制的需求.Access control models proposed so far cannot satisfy the access requirements in workflow systems very well. To address the issue, a flexible policy access control model for workflows was proposed. By the introduction of authorization certificate, which defines the authorization that can be performed during task execution and the constraints should be satisfied, dynamic access control in workflows is realized and the flexible definition of authorization policies is supported. For the description of complicated authori- zation rules, authorization certificate related constraints were defined. Furthermore, efficient conflict detection and resolution rules for authorization constraints were also provided. Analysis shows that the model has good security and practicability. It can meet the requirements for access control in workflow systems adequately.

关 键 词：工作流 访问控制 授权许可 授权约束 冲突检测与消解 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]