业务流程授权约束依从性分析  

Compliance Analysis of Authorization Constraints in Business Process

作　　者：薄阳 夏春和[1,2,3] 

机构地区：[1]网络技术北京市重点实验室(北京航空航天大学),北京100191 [2]北京航空航天大学计算机学院,北京100191 [3]广西师范大学计算机科学与信息工程学院,广西桂林510004

出　　处：《计算机研究与发展》2017年第10期2404-2418,共15页Journal of Computer Research and Development

基　　金：国家自然科学基金联合基金项目(U1636208);中航工业产学研项目(CXY2011BH07)~~

摘　　要：授权约束的依从性研究是业务流程安全领域中的重要研究内容.针对授权约束提出了全新的业务流程依从性分析框架,该框架可以处理:1)流程授权和非流程授权;2)业务流程任务委托;3)角色继承关系;4)职责分离和职责绑定约束;5)静态约束和动态约束.提出授权图表示依从性分析框架,并给出授权图的构造和化简方法对授权图进行维护,然后设计了针对授权图的依从性分析算法.基于分析结果,给出了不依从授权约束的冲突模式,针对每一种冲突模式设计一组解决方案,并实现了原型系统.所提出的授权约束依从性分析框架独立于系统部署的平台,适用范围广泛.最后通过实例分析和实验验证说明了该方法的有效性.A novel framework of business process compliance analysis is proposed in this paper,and the proposed framework can process 1)business process authorization and non-business process authorization;2)delegation of task of business processes;3)inheritance of roles;4)separation of duty and binding of duty constraints;5)statics constraints and dynamic constraints.Authorization graph is proposed to describe the framework,and construct and reduce methods of authorization graph are designed to maintain the graph,then compliance analysis algorithms of authorization graph are proposed.Based on the analysis results,conflict patterns are presented.A set of resolutions for each pattern are provided,and a prototype system is implemented.The framework of authorization constraint compliance analysis,independent of platform,can be widely applied to system security analyzing.The effectiveness of the proposed method is reported by a case study and experiments at the end of this paper.

关 键 词：业务流程 授权约束 依从性 职责分离 职责绑定 任务委托 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]