資料庫線上核發系統規劃研究-以C公司為例

Planning A Database Online Authorization System- A case study of C Company

吳國樑(Kuo-Liang Wu)

指導教授 ： 楊承亮

大同大學/經營設計學院/資訊經營學系所/碩士(2009年)

摘要

資料庫為提供存放資料的儲存體，是企業中一項重要的無形資產，協助企業內部人員透過合法的授權，並順利取得資料庫中資料，經由整理分析後產生有用的資訊，進而創造出更大的利益，此為資料庫管理人員非常重要的工作之一。
現今的資料庫管理系統例如ORACLE、DB2與MSSQL已提供非常完善的管理介面，輔助資料庫帳號的管理。經探討本研究之個案，我們發現在分散式環境下，當資料庫帳號成長至一定規模時，將產生許多管理與維護的問題，例如資料庫帳號分散至各資料庫伺服器，使得管理人員無法有效率的集中管理。再者，資料庫帳號與密碼的保管，可能因人員保管不慎而發生外洩問題。
本研究以個案公司在資料庫管理系統中，人工核發帳號所遭遇的問題，提出一個三階段改善作業流程，分別為授權管理、申請取得與系統刪除。為完成新的作業流程，開發出網頁服務模組、觸發模組、刪除批次模組、自動報表模組與資訊收集批次模組，提供整個系統的運作。模組的設計參考文獻中相關概念與方法，其中網頁登入驗證的設計以「單一簽入」概念結合個案公司中「動態目錄服務」；資料庫帳號與密碼核發的設計運用「一次性密碼」概念；資料庫授與作業的設計則運用「角色為基礎的存取控制」概念。此外參酌「系統品質」的文獻，將可靠穩定度、反應時間與操作容易性等因素納入本設計重要的考量。
所開發資料庫線上核發系統導入於個案公司，原資料庫管理人員需人工介入的作業大幅降低，所需的作業時間較原有方式節省數倍之多。此外，解決原有作業中資料庫帳號無法有效集中管理、人員保管密碼不慎發生外洩等諸多問題。

關鍵字

資料庫管理系統 ； 動態目錄服務 ； 單一簽入 ； 一次性密碼 ； 角色為基礎的存取控制 ； 系統品質

並列摘要

Database is a storage unity, provides data keeping, which is an important and invisible property for business enterprises, and assists the members of the business enterprise to get data smoothly from the database though legal authorization, and then arrange and analyze it for getting useful information, furthermore to create more benefits which is one of the crucial tasks of the database administrators.
Nowadays, the database management systems such like ORACLE, DB2 and MSSQL have already supplied quite good management interface for supporting the management of the accounts in database. By exploring the specified company as the case studied in this research, we found that there are many problems relevant to management and maintenance came out under the dispersed environment when the accounts in database increased till certain amount, for instance, the accounts in database are dispersed to different database servers, in this case, the centralized management can not be done efficiently. Moreover, the keeping of the accounts in database and passwords are possibly disclosed by the users’ careless manner.
In this paper, through the problems of issuing the accounts manually faced by the database management system of the studied case, we raise the three-step corrective operation flow; these are Authorization Management, Application Receipt and System Deletion. For the purpose to complete the new operation flow, we develop the Web Service Modules; Trigger Modules, Delete Batch Modules, Automatic Report Modules and Get Information Batch Modules, to provide the operation for all the system. The relevant concepts and methodologies of reference literature to design the models are connecting the Single Sign On concept applied by the designed accounts in database and issuing password with the Active Directory Service of the cased company; the design of database authorization operation is made use of the concept of Role-Base Access Control. In addition, referring to the System Quality literature, we consider the reliability, stability, and reaction timing and operation easiness as the important factors of this design.
The on Line Issuing System of the developed database is applied on the studied case, the previous database administrator reduces the involvement of manual operation, and the operation timing is much shorter than before. Additionally, resolving the problems of unable to centralize the management of the accounts in database or the account users leaking out the password without caution and so on.

並列關鍵字

Database Management System ； Active Directory ； Single Sign On ； One Time Password ； Role-Base Access Control ； System Quality

參考文獻

[20] 陳峰棋，「深入淺出ASP.NET程式設計」，台北，知城科技股份有限公司， 2003。

[2] Chandramouli, R. ,“A framework for multiple authorization types in a healthcare application system”, Computer Security Applications Conference, 2001. ACSAC 2001. Proceedings 17th Annual,pp. 137-148, Dec. 2001

[3] Feichtinger, D. and Peters, A.J. ,“Authorization of data access in distributed storage systems”, Grid Computing, 2005. The 6th IEEE/ACM International Workshop,pp.7, Nov. 2005

[5] Habtamu Abie and Pål Spilling and Bent Foyn,“A distributed digital rights management model for secure information-distribution systems”, International Journal of Information Security, Volume 3, Number 2 / November, 2004

[7] Ngo, L. and Apon, A. ,“Using Shibboleth for Authorization and Authentication to the Subversion Version Control Repository System”, Information Technology, 2007. ITNG '07. Fourth International Conference,pp.760-765,Apr. 2007