业务流程授权约束依从性分析

Compliance Analysis of Authorization Constraints in Business Process

授权约束的依从性研究是业务流程安全领域中的重要研究内容.针对授权约束提出了全新的业务流程依从性分析框架,该框架可以处理:1)流程授权和非流程授权;2)业务流程任务委托;3)角色继承关系;4)职责分离和职责绑定约束;5)静态约束和动态约束.提出授权图表示依从性分析框架,并给出授权图的构造和化简方法对授权图进行维护,然后设计了针对授权图的依从性分析算法.基于分析结果,给出了不依从授权约束的冲突模式,针对每一种冲突模式设计一组解决方案,并实现了原型系统.所提出的授权约束依从性分析框架独立于系统部署的平台,适用范围广泛.最后通过实例分析和实验验证说明了该方法的有效性.

A novel framework of business process compliance analysis is proposed in this paper,and the proposed framework can process 1)business process authorization and non-business process authorization;2)delegation of task of business processes;3)inheritance of roles;4)separation of duty and binding of duty constraints;5)statics constraints and dynamic constraints.Authorization graph is proposed to describe the framework,and construct and reduce methods of authorization graph are designed to maintain the graph,then compliance analysis algorithms of authorization graph are proposed.Based on the analysis results,conflict patterns are presented.A set of resolutions for each pattern are provided,and a prototype system is implemented.The framework of authorization constraint compliance analysis,independent of platform,can be widely applied to system security analyzing.The effectiveness of the proposed method is reported by a case study and experiments at the end of this paper.