version 1.0 Workflow Authorization Model james MSN

Size: px

Start display at page:

Download "version 1.0 Workflow Authorization Model james MSN"

欧籍
4 years ago
Views:

1 Workflow Authorization Model james MSN 1

2 Subject-Object View Authorization-step Core RBAC User Role session Core RBAC

3 Role-based Task-based Task-based 2. version 1.1 A A B B C C Task A Task B Task C B B B C C 3

4 (Task-Based Authorization Model) (Role-Based Access Control Model) subject-object view of access control subject-object 3. Subject-Object View subject-object view traditional passive subject-object access matrix 1969 B.W. Lampson subject object access matrix i j Mij i Si j Oj Mij {read, write} Si Oj Subject A Subject B Object A R W Object B RW R subject-object Subject Object Right subject-object view Subject S,Object O,Right R subject-object so 4

5 4. Active security model subject-object TBAC Active security model / A B Permission Permission State TBAC Dependency AS Authorization Step 4.1. Authorization-step R.S97 life-cycle of authorizations 5

6 4.2. TBAC0 4 Separation Dependency Existential Temporal concurrency Existential Temporal concurrency 1 A state1 B state2 A state1 B state2 2 A state1 < B state2 A state1 B stat2 A B 3 A state1 X B state2 B state2 A state1 4 A state1 B state2 B state2 A state1 1 2 Existential Dependency and Temporal Dependency state permission state TBAC TBAC msn 5. Subject-Object MAC DAC / Role-based Ravi Sandhu 2000 RBAC RAV00 6

7 RBAC OS 5.1. Core RBAC RBAC Core RBAC RBAC Users Roles permissions objects OBS operations OPS assigment session Users User Assignment Roles Permission Assignment OPS OBS Sessions RBAC User Role User Role User Role permission OP OB A B A B object OB permission object object operation OP permission operation operation 7

8 assignment user permission assignment object opertiaon session session web session session A A B Sandhu Role-based Access Control RBAC User Role Authorization Session Rights User Group Object 5.2. Core RBAC RBAC Hierarchal RBAC Constrained RBAC Ravi Sandhu RBAC RAV00 Hierarchal RBAC Composite Roles Composite Roles Ua Ra Rb Ua CRa Ra Rb Ua Ra Rb 8

9 5.3. D1 D2 A B C D21 D 1 D2 D21 2 User 3 C D A D LDAP A A LDAP 9

10 5.4. Project Manager Team Leader PM TL Hierarchal RBAC Composite Roles Core RBAC permission assignment Core RBAC Hierarchical Roles Project Lead Production Engineer 10

11 Director Project Lead 1 Project Lead 2 Production Engineer 1 Quality Engineeer 1 Production Engineer 2 Quality Engineer 2 RAV00 Core RBAC Composite Roles

12 User Assignment User Assignment 5.6. Core RBAC User Assignment Design 5.7. Core RBAC Permission Assignment Task Core RBAC Permission Core RBAC objects OBS operations OPS

13 1 A B Task A Task B Task C 2 A Task B F1 F2 B A 3 A Task B E1 A E2 B 1 XPDL 13

14 2 3 Degine Engine 3 RiseSoft RiseOffice Ua Ra Rb O Rb Ua O Ua O Hierarchal RBAC 6. R.S97 R. K. Thomas R. S. Sandhu Task-based Authorization Controls A Family of Models for Active and Enterprise-oriented Authorization Management ROS96 Roshan Thomas Task-based Authorization: A Research Project in Next-generation Active Security Models for Workflows RAV00 Ravi Sandhu,David F. Ferraiolo, Serban Gavrila, A Proposed Standard for Role-Based Access Control RAV96 Ravi Sandhu,Edward J.Coyne,Hal L.Feinstein,Charles E.Youman Role-Based Access Control Models RAV97 Ravi Sandhu Rationale for the RBAC96 Family of Access Control Models RAV97 Vijayalakshmi Atluri,Wei-Kuang Huang An Authorization Model for Workflows SHE02 Shengli Wu 14

15 Authorization and Access Control of Application Data in Workflow Systems Eduardo B. Fernandez Happy UMLChina R. K. Thomas Task-based Authorization Controls A Family of Models for Active and Enterprise-oriented Authorization Management Subject-Object TBAC SO SO TBAC Core RBAC RAV96 RAV

Value Chain ~ (E-Business RD / Pre-Sales / Consultant) APS, Advanc

Value Chain ~ (E-Business RD / Pre-Sales / Consultant) APS, Advanc Key @ Value Chain fanchihmin@yahoo.com.tw 1 Key@ValueChain 1994.6 1996.6 2000.6 2000.10 ~ 2004.10 (E- RD / Pre-Sales / Consultant) APS, Advanced Planning & Scheduling CDP, Collaborative Demand Planning