| Summary: | 碩士 === 國立清華大學 === 工業工程與工程管理學系 === 91 === In general, today’s companies manage business information with computer systems. Many users share and access the computerized information for executing their job functions. As a result, security problems have become increasingly difficult. Especially access control has become an important security issue in the enterprise environment.
In order to secure the information assets from being stolen and unauthorizedly disclosed, the most useful tool nowadays is the Role-based access control (RBAC) methodology suggested by National Institute of Standards and Technology (NIST). Although Role-based access control is known to be a proper model for enterprise environment, the lack of flow control concepts cause this theory still has some unsolved questions. To control the characteristics of workflow, such as the order of activities, the states of activities, RBAC needs more precise rules and definitions. For this reason, we intend to propose an integration model to improve RBAC with workflow access control mechanism (W-RBAC) that can afford enterprise a proper access control model. There are three main stages to develop W-RBAC: (1) Integrate Role-based and Activity-based Access Control theories. (2) Design UML-based of W-RBAC Model. (3) Verify the Functionalities of W-RBAC Model:
This model is expected to have the following advantages: (1) Provide enterprise environment a workflow access control model based on RBAC theory. (2) Integrate role-based access control with activity-based access control concepts. (3) Redesign the SoD principal into the model that such the conflict of interest between system users and their actions can be specified.
|
|---|
