具流程管理機制之工作存取權限控制模型之研究

Design of Job-Based Access Control Model with Workflow Mechanism

施淵仁(Yuan-Ren Shih)

指導教授 ： 黃士殷

元智大學/資訊學院/資訊工程學系/碩士(2000年)

摘要

角色為基礎之存取控制模型(Role-Based Access Control, RBAC)是由美國國家標準局（NIST）近年來提出的資料存取機制，RBAC提出具彈性的存取控制機制，不過RBAC目前只能被應用在特定系統[4][8]，因此許多文獻對於RBAC提出改進與應用的方法。但是RBAC目前仍然存在無法對具有連續性動作或事件進行控制之限制，亦即缺乏工作流程(Workflow)的控制機制，本論文的目的即對此一限制提出改進方法。
目前有文獻針對RBAC物件與權力管理提出改進的方法，稱為"工作權責為基礎之存取控制模式" (Job-Based Access Control Model,JBAC)[15]， JBAC模型的優點可降低RBAC權力管理複雜度，因此本論文採用JBAC模型為架構基礎，將Task-Based Authorization中[11]工作流程(Workflow)的概念加入JBAC的Job分派流程，並與RBAC的角色分派機制結合，再對於模型中每個元件逐一檢視存取控制的原則，使整體模式具備資料存取控制(Access Control)與工作流程控制(Workflow)的特性，更能符合系統實際需求，提供系統發展者及管理者一個易於發展與管理的資料存取機制。

關鍵字

存取控制 ； 工作流程 ； 工作權責為基礎之存取控制 ； 角色為基礎之存取控制

並列摘要

The Role-Based Access Control (RBAC), suggested by National Institute of Standards and Technology (NIST), is an access control model. Although RBAC is a new method for modern information system, RBAC is still not a panacea for all access control issue. In RBAC, permissions are associated with roles. Permission assign to objects and users is a complex problem. This problem has been solved by Job-Based Access Control (JBAC).
But Role-based Access Control still has some problems. The most problem is that RBAC does not attempt to direct control permission for sequence of events or activities in system., and there is other forms of access control discuss the matter about workflow control. Task-based Authorization Model discussed part of this issue.
In this paper we will take advantage of the concept of workflow and combine it with JBAC to solve this limitation of RBAC. We will provide a suitable model to deduce to the complexity of administration and to manage objects and permissions easier.

並列關鍵字

Role-Based Access Control ； Job-Based Access Control ； Access Control ； Workflow

參考文獻

[1] R. S. Sandhu, P, Samarati, "Access Control: Principles and Practice", IEEE Comm. Magazine, Sep. 1994, p40-48

[2] R.S. Sandhu, E.J. Coyne, "Role-based Access Control Models", IEEE Computer, Feb, 1996, pp.38-47

[5] R.S.Sandhu, et al, "Role-based Access Control: A Multi-Dimensional View", Proc. Of computer Security application Conf., Orlando, Florida, Dex5-9, 1994, pp. 54-62

[6] John Barkley, "Comparing Simple Role Based Access Control Models and Access Control Lists", August, 1997.

[7] Fang Chen and Ravi S. Sandhu, "Constraints for Role-Based Access Control", ACM RBAC Workshop, MD, 1996