Towards agent-oriented model-driven architecture

Model-Driven Architecture (MDA) supports the transformation from reusable models to executable software. Business representations, however, cannot be fully and explicitly represented in such models for direct transformation into running systems. Thus, once business needs change, the language abstractions used by MDA (e.g. object constraint language/action semantics), being low level, have to be edited directly. We therefore describe an agent-oriented MDA (AMDA) that uses a set of business models under continuous maintenance by business people, reflecting the current business needs and being associated with adaptive agents that interpret the captured knowledge to behave dynamically. Three contributions of the AMDA approach are identified: (1) to Agent-oriented Software Engineering, a method of building adaptive Multi-Agent Systems; (2) to MDA, a means of abstracting high-level business-oriented models to align executable systems with their requirements at runtime; (3) to distributed systems, the interoperability of disparate components and services via the agent abstraction.     

Modellierungsunterstützung für die rollenbasierte Delegation in prozessgestützten Informationssystemen

In the paper, an integrated approach for the modeling and enforcement of delegation policies in process-aware information systems is presented. In particular, a delegation extension for process-related role-based access control (RBAC) models is specified. The extension is generic in the sense that it can be used to extend process-aware information systems or process modeling languages with support for process-related RBAC delegation models. Moreover, the detection of delegation-related conflicts is discussed and a set of pre-defined resolution strategies for each potential conflict is provided. Thereby, the design-time and runtime consistency of corresponding RBAC delegation models can be ensured. Based on a formal metamodel, UML2 modeling support for the delegation of roles, tasks, and duties is provided. A corresponding case study evaluates the practical applicability of the approach with real-world business processes. Moreover, the approach is implemented as an extension to the BusinessActivity library and runtime engine.     

Combined access control model embedding configurable policy for fine-grained data security

With the wide applications of the Internet of Things, a lot of business data is generated by mobile embedded devices, and traditional data access control faces the new security risk. To enforce security and privacy requirements of information, the fixed data access control model needs to be added with the configurable authority policy, and it is necessary to ensure that new model is embedded without changing the original architecture. In this paper, we study the data access strategies on BlueKing platform, and design an embedded model by combing the role-based access control (RBAC) and label-based access control (LBAC) for fine-grained data access control. In proposed model, we first obtain the preliminary permissions result by using the original RBAC method. Then, we analyze the difference between the requirements and preliminary result, and we design the embedded polices components based on LBAC for the original framework. Finally, we generate the data access result for row and column by parsing the requirements with authority policies. The proposed model does not invade the original RBAC, and perform the fine-grained data access control, which has begun to be integrated into BlueKing platform.     

基于业务流程的访问控制模型研究开发

在分析研究RBAC基本模型的基础上，根据网上申报、审批系统的实际需求，提出了一种基于业务流程的访问控制模型，将业务流程和基于角色的权限控制相结合，在业务流程和角色之间建立有效的联系，使有关业务流程的信息能够直接指导角色的设置。该模型克服了RBAC基本模型需要修改角色权限来适应不同业务流程的缺点，真正实现了权限的按需、按流程分配，角色只有在执行特定子任务时才具有权限，权限的分配和回收由系统动态实现。该模型已在网上申报、审批系统项目中应用。     

Adaptive Agent Model: Software Adaptivity using an Agent-oriented Model-Driven Architecture

Model-Driven Architecture (MDA) promotes the development of software systems through successive building and generation of models, improving the reusability of models. Applying the same principles to the area of Agent-Oriented Software Engineering (AOSE) advances the ideas behind MDA even more significantly, due to the inherent adaptivity of software agents We describe an appropriate set of models originating from requirements specification and transformable to models understandable and executable by agents thus demonstrating an Agent-oriented Model-Driven Architecture (AMDA) approach. In AMDA, agents use hierarchical business knowledge models with business process rules at the top, business rules to control policy and logic in the middle and a base layer defining business concepts. Being externalised, knowledge is easily configurable by human beings and applied by software agents. A real case study is used to illustrate the process. The main advances over the object-oriented MDA are (i) the addition of component dynamics (ii) the use of agent-executable rule-based business models and (iii) a proposed higher level of abstraction with the direct representation of business requirements.     

一种基于任务和角色的访问控制模型及其应用

近年来RBAC(Role-Based Access Control)及TBAC(Task-Based Access Control)模型得到广泛的研究。文中比较了一些现有访问控制模型的各自特点和适用范围,针对现有模型的不足,为了提高系统的安全性、通用型和实用性,通过结合RBAC及TBAC模型各自的优点,提出了一个新型的访问控制模型T-RBAC(Task-Role Based Access Control)。描述了T-RBAC模型结构和特点,阐述了模型对最小权限原则、职权分离原则、数据抽象原则及角色层次关系的支持,给出了模型在协同编著系统中的一个应用和将来工作的主要目标。     

FMS多智能体调度系统的角色建模

为了实现FMS多智能体调度系统,提出一种基于角色的系统体系结构。根据该结构的逻辑过程设计出调度系统的招标委员会流程角色模型,并对每个智能体进行角色分配,定义其工作方式与数据访问方式。通过角色的泛化和聚合,使得系统中的智能体协同能力和适应能力更强。     

基于角色的权限控制在URP系统中的应用

在基于角色的权限控制(RBAC)模型的基础上,提出了一套适用于URP系统的权限管理应用模型,不仅使URP系统安全管理方案较科学地应用于实际系统职责管理,而且简化了URP系统中对用户授权管理的过程.     

DW-RBAC: A formal security model of delegation and revocation in workflow systems

One reason workflow systems have been criticized as being inflexible is that they lack support for delegation. This paper shows how delegation can be introduced in a workflow system by extending the role-based access control (RBAC) model. The current RBAC model is a security mechanism to implement access control in organizations by allowing users to be assigned to roles and privileges to be associated with the roles. Thus, users can perform tasks based on the privileges possessed by their own role or roles they inherit by virtue of their organizational position. However, there is no easy way to handle delegations within this model. This paper tries to treat the issues surrounding delegation in workflow systems in a comprehensive way. We show how delegations can be incorporated into the RBAC model in a simple and straightforward manner. The new extended model is called RBAC with delegation in a workflow context (DW-RBAC). It allows for delegations to be specified from a user to another user, and later revoked when the delegation is no longer required. The implications of such specifications and their subsequent revocations are examined. Several formal definitions for assertion, acceptance, execution and revocation are provided, and proofs are given for the important properties of our delegation framework.     

基于授权对象的角色控制模型的应用研究

权限策略在集团化企业安全需求扮演重要角色,而基于角色的访问控制（RBAC）模型是目前的研究热点.将RBAC模型优化,结合旅游集团综合信息化管理系统的要求及实际岗位情况,将权限在角色、操作等维度上进一步细化,把业务部门间的相互关系跟系统中的角色结合起来,提出了基于授权对象的角色访问控制模型（AURBAC）,从而实现旅游集团信息系统中的权限管理.     

Role-Based Access Controls: Status, Dissemination, and Prospects for Generic Security Mechanisms

E-commerce applications have diverse security requirements ranging from business-to-business over business-to-consumer to consumer-to-consumer types of applications. This range of requirements cannot be handled adequately by one single security model although role-based access controls (RBAC) depict a promising fundament for generic high-level security. Furthermore, RBAC is well researched but rather incompletely realized in most of the current backend as well as business layer systems. Security mechanisms have often been added to existing software causing many of the well-known deficiencies found in most software products. However, with the rise of component-based software development security models can also be made available for reuse. Therefore, we present a general-purpose software framework providing security mechanisms such as authentication, access controls, and auditing for Java software development. The framework is called GAMMA (Generic Authorization Mechanisms for Multi-Tier Applications) and offers multiple high-level security models (including the aforementioned RBAC) that may even be used concurrently to cover such diverse security requirements as found within e-commerce environments.     

科学工作流管理系统中基于用户分组的角色访问控制

访问控制机制是科学工作流管理系统中安全控制的重要内容。本文在事务工作流系统中基于角色的访问控制模型的基础上,结合科学工作流的特点和需求,提出了基于用户分组的角色访问控制机制（UGRBAC）;在科学工作流管理系统中增加单独的访问控制模块,在科学工作流流程定义阶段以及工作流执行阶段对用户进行访问控制,有效地控制了各类用户对服务和资源访问的限制,并且为服务提供者提供了访问权限设置的功能。     

工作流系统上下文相关访问控制模型

访问控制是提高工作流系统安全性的重要机制。基于角色的访问控制（RBAC）被绝大多数工作流系统所采用，已成为工作流领域研究的热点。但是，现有的基于角色的访问控制模型没有考虑工作流上下文对任务执行授权安全的影响，容易造成权限冗余，也不支持职责分离策略。该文提出一种工作流上下文相关访问控制模型WfCAC，首先，定义该模型的构成要素和体系结构，然后讨论工作流职责分离和访问控制机制，并对模型性质进行分析。WfCAC模型支持用户组及其层次结构，支持最小权限授权策略和职责分离策略，实现了工作流上下文相关访问控制。     

扩充角色层次关系模型及其应用

基于网络的大规模软件应用系统面临着日益复杂的数据资源安全管理的难题.基于角色的访问控制方法(role-based access control,简称RBAC)实现用户与访问权限的逻辑分离和构造角色之间的层次关系,从而方便了数据的安全管理.该文在RBAC96模型的基础上,对角色之间的层次关系进行了扩充,定义了角色的公共权限和私有权限,引入了一般继承和扩展继承机制,形成了一个能描述复杂层次关系的角色访问控制模型EHRBAC(extended hierarchy role-based access contro     

基于RBAC的两级访问控制模型

基于网络的大规模软件应用系统面临着日益复杂的数据资源安全管理的难题,基于角色的访问控制方法(Role Based Access Control,简称RBAC),实现用户与访问权限的逻辑分离和构造角色之间的层次关系,从而方便了数据的安全管理。基于角色的访问控制的基础,对角色进行进一步划分,分为模块级角色和数据级角色。一个模块级角色包含至少一个或者多个数据级角色。以角色间包含关系取代RBAC中角色之间的继承关系,有效的防止了角色间继承带来的冗余隐患。     

Access-control language for multidomain environments

The XML role-based access control (X-RBAC) specification language addresses multidomain environments' policy-specification needs. X-RBAC is based on an extension of the widely accepted US National Institute of Standards and Technology role-based access-control (RBAC) model. In addition to allowing specification of RBAC policies and facilitating specification of timing constraints on roles and access requirements, X-RBAC provides a framework for specifying mediation policies in a multidomain environment where RBAC policies have been employed.     

RBAC在B／S模式信息管理系统中的研究与实现

基于角色的访问控制（RBAC）具有减少授权管理复杂性、降低管理开销、增强系统安全性等优良特性。本文分析了RBAC模型的基本原理、结构,描述了RBAC在B／S模式信息管理系统中的应用模型,并将这种新的应用模型应用到某公司的业务信息管理系统开发中,实现了用户与角色相关联、角色与权限相关联,不同用户拥有不同的操作权限,增加了系统使用的安全性以及系统管理的工作效率。     

基于角色的访问控制扩展模型及其实现

提出了一种改进的RBAC模型,该模型通过引入安全员、审计员、主客体安全等级、角色容量等概念,对传统RBAC模型进行了扩展,克服了传统RBAC中判断程序的权限仅仅根据启动程序的角色的不足,提高了模型的安全性.最后通过一个应用实例验证了新模型的有效性.     

基于多维度量和上下文的访问控制模型

在分布式系统中,用户身份难以确定、接入平台复杂,且网络环境动态多变,传统的基于角色或身份的访问控制模型已无法满足用户需求。为此,结合基于角色访问控制(RBAC)和信任管理(TM)的特点,在RBAC的基础上,引入信任与上下文的概念,对用户身份、接入平台及用户行为进行多维度量,根据网络环境和用户状态的动态多变性,提出一种基于多维度量和上下文的访问控制模型(MCBAC),该模型主要依据用户的身份信息和可信度分配角色,通过上下文约束,实现动态角色授权控制,具有较高的安全性及较好的灵活性。     

基于RBAC的员工管理系统设计

分析了RBAC模型的基本原理、结构,描述了RBAC在B/S模式信息管理系统中的应用模型,并将这种新的应用模型应用到客服中心员工管理信息系统开发中,实现了用户与角色相关联、角色与权限相关联,不同用户拥有不同的操作权限,增加了系统使用的安全性以及系统管理的工作效率。