Graph-based access control: Difference between revisions

Revision as of 09:34, 15 July 2015

Revision as of 09:39, 15 July 2015

Line 6:

== History ==

The foundations of GBAC go back to a research project named CoCoSOrg (Configurable Cooperation System) [<ref>{{cite book|last1=Schaller|first1=Thomas|title=Organisationsverwaltung in CSCW-Systemen|date=1998|publisher=Bamberg University|___location=Bamberg}}</ref>] (in English language please see <ref name = EOMAS>{{cite book|last1=Lawall, Schaller, Reichelt|title=Enterprise Architecture: A Formalism for Modelling Organizational Structures in Information Systems|date=2014|publisher=Enterprise and Organizatinal Modeling and Simulation: 10th International Workshop CAiSE2014|___location=Thessaloniki}}</ref>) where the organization graph and a formal language was used to specify agents and their access rights in a workflow environment. Within the project COrg the approach was extended by features like separation of duty, access control in virtual organizations <ref>{{cite journal|last1=Lawall, Schaller, Reichelt|title=Restricted Relations between Organizations for Cross-Organizational Processes|journal=IEEE 16th Conference on Business Informatics (CBI),Geneva|date=2014|pages=74-80}} [</ref> and subject-oriented access control <ref>{{cite book|last1=Lawall, Schaller, Reichelt|title=S-BPM in the Wild: Role and Rights Management|date=2015|publisher=Springer|___location=Berlin|isbn=978-3-319-17541-6|pages=171-186|edition=1}}</ref>].

== Definition ==

Line 18:

The organization graph is divided into a type and and an instance level. On the instance level there are node types for organization units, functional units and agents. The basic structure of an organization is defined using the so called structural relation that defines which functional units belongs to which organization unit and which agent fulfills which function. Additionally there specific relationship types like deputyship or informs that can be extended by the user. All relationships can be context sensitive via the usage of attributes defining constraints that have to be fulfilled in order for the arc to be valid.

The type level is used for the purpose of re-usage. It consists of organization unit types, functional unit types and the same relationship types as on the instance level. Types are typical organization structures that can be used to create new instances or reuse organization knowledge in case of exceptions (pleasefor seefurther nextreading see paragraph).

[[File:GBACOrgGraph.pdf|thumb|Organization Graph in GBAC]]