论文部分内容阅读
传统的基于角色的访问控制应用于电力工作流系统中能大大简化用户的权限管理。然而,仅使用角色的概念不足以反映企业的组织结构,而且不能为任务指定组织单元,角色之间的权限继承关系与电力工作流应用实际不相符,静态的访问控制约束不能满足电力工作流的动态需求。因此,提出了一种基于组织和任务的访问控制模型。该模型去除了角色之间的权限继承关系,引入组织单元和任务的概念,将任务分为普通任务和专门任务,普通任务分配到组织单元,可以被继承,专门任务分配到组织单元中的角色,不能被继承,再将权限分配给任务,用户通过分配组织单元中的角色或组织单元来获得执行任务的权限。结合提出的模型,通过给每个任务定义黑名单数据结构,给出了一种动态的访问控制算法。最后以变电站设备检修工作流为例给出了具体的动态访问控制设计,实例表明该模型和算法可以实现动态的权责分离及权责绑定约束。
The traditional role-based access control applied to power workflow system can greatly simplify the user’s rights management. However, the concept of using only roles is not enough to reflect the organizational structure of enterprises, and organizational units can not be assigned to tasks. The inheritance relationship between roles does not actually match the application of power workflow. Static access control constraints can not meet the requirements of power workflow Dynamic demand. Therefore, a model of organization and task-based access control is proposed. The model removes the inheritance relationship between roles, introduces the concepts of organizational units and tasks, divides the tasks into common tasks and specialized tasks, the common tasks are assigned to organizational units, which can be inherited, and the special tasks are assigned to the roles in the organizational unit , Can not be inherited, and then assigned permissions to the task, the user by assigning the role of the organizational unit or organizational unit to obtain the mandate to perform tasks. Combined with the proposed model, a dynamic access control algorithm is given by defining the blacklist data structure for each task. Finally, the concrete dynamic access control design is given by taking substation equipment maintenance workflow as an example. The example shows that the model and algorithm can realize the dynamic separation of rights and responsibilities and binding of power and responsibility.