基于委托的工作流访问控制模型

从工作流访问控制模型与流程模型分离的角度，提出一种基于委托的工作流访问控制（DBWAC）模型．为了管理流程中执行任务需要的权限，引入了虚拟委托用户的概念．在DBWAC模型中，虚拟委托用户是流程中任务的抽象和访问控制实施的基本单元，权限同虚拟委托用户相关联．在任务开始执行时，虚拟委托用户将权限委托给任务的执行用户并在任务执行完成后将委托撤销，使用委托约束、委托条件保证委托的可控性．通过该模型不仅可以满足工作流访问控制的要求，并且可以实现委托，提供了一种具有柔性和可控的授权方式．

Delegation Based Workflow Access Control Model

In view of decoupling the workflow access control model from the process model,a delegation-based workflow access control(DBWAC) model is presented.This paper proposes the concept of virtual delegator(VD) in order to manage the permissions involved in a task of a process.In DBWAC,VD is the abstraction of a task and the unit for applying access control.Permissions are associated with VD.VD can delegate its permissions to a user who can carry out a task that the VD is associated with.And when the user is out ...