面向业务流程驱动的细粒度权限控制系统设计与实现

发布时间：2018-09-09 11:23

【摘要】：随着人力资源与社会保障领域信息化的不断发展,养老医疗、劳动关系、就业创业、人事人才等业务系统已经实现了业务流程驱动。引入业务流程后的人社领域各系统,多个组织机构的用户协同参与一项业务的办理,不仅要限制参与办理的系统用户拥有的功能操作权限,还要对功能操作可以访问的数据资源范围做出更进一步的限制。人社领域领域业务复杂,大量涉及资金的征缴与发放,有着类似于金融行业的特点,因此,必须对业务系统功能操作可以被分配的用户范围,做出符合实际业务情况的严格限制,才能保证功能权限被分配到正确合法的用户,以防止误操作和业务的越权办理。面向业务流程驱动的细粒度权限控制系统,主要负责针对流程驱动的人社领域各业务系统实现细粒度的权限控制。在业务流程驱动的背景下,结合组织目录,提出业务岗位模型,该模型在TRBAC模型的基础上,引入隶属机构,限制当前业务岗位对应的功能操作,只能分配给隶属机构下的用户。引入虚拟的业务机构,限制当前任务对应的功能,只能操作属于当前业务机构的数据资源。借助组织机构,对流程驱动的业务系统的功能操作可以访问的数据资源范围和可以分配的用户范围,实现更细粒度的控制,是本系统解决的核心问题。本论文首先对业务流程和访问控制的研究现状进行了分析,并指出了系统解决的关键问题及创新点。需求分析阶段,通过综合分析业务流程驱动的人社领域各系统的组织目录管理和权限控制需求,给出部分用例图和用例描述。结合需求分析和相似系统的经验,本文论述了系统的设计和实现过程。总体设计中,对本系统组织机构类型、业务岗位模型、数据库概念模型、技术架构进行了设计,给出了技术架构图、E-R图、组织机构类型图。详细设计阶段,给出系统关键模块的类图,还对数据库表结构和关键界面原型,进行了细致的设计。系统实现与测试部分,对系统实现采用的Activiti、BPMN、工单账务等关键技术做了详细说明,并描述了关键模块的实现,还从功能、性能和浏览器兼容性方面给出了本系统的测试结果。最后,对全文做出了总结,展望了本系统的研发前景。
[Abstract]:With the continuous development of information technology in the field of human resources and social security, business systems such as pension care, labor relations, employment and entrepreneurship, personnel and other personnel have been driven by business processes. Users of the system have the authority to operate functions, but also to make further restrictions on the scope of data resources that can be accessed by functional operations. The fine-grained privilege control system for business process-driven is mainly responsible for implementing fine-grained privilege control for business systems in the process-driven human society domain. Under the background of business process-driven, combined with organizational catalogue, a business Post model is proposed. On the basis of TRBAC model, a subordinate organization is introduced to restrict the function operation corresponding to the current business post, which can only be assigned to the users under the subordinate organization. Data resources of current business organizations. With the help of organizational structure, it is the core problem of the system to realize finer-grained control over the range of data resources that can be accessed and the range of users that can be allocated by the functional operations of process-driven business systems. Firstly, the research status of business processes and access control is analyzed. At the stage of requirement analysis, by analyzing the requirement of organizational catalogue management and authority control of each system in the field of human society driven by business process, some use case diagrams and use case descriptions are given. Combined with requirement analysis and the experience of similar systems, the design and implementation of the system are discussed in this paper. In the overall design, the system organization type, business position model, database conceptual model and technical framework are designed. The technical framework diagram, E-R diagram and organization type diagram are given. In the detailed design stage, the class diagram of the key modules of the system is given, and the database table structure and the key interface prototype are designed in detail. In the part of system implementation and testing, the key technologies of Activiti, BPMN, work order and accounting are described in detail, and the implementation of the key modules is described. The test results of the system are also given from the aspects of function, performance and browser compatibility. Finally, the paper summarizes the whole paper and looks forward to the development prospect of the system.
【学位授予单位】：山东大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309;TP311.52

【相似文献】