中文摘要：

为了满足产品研发工作流中权限配置与使用的要求,将属性概念贯穿到任务权限的定义、配置和使用整个过程中,为权限控制提供更加丰富的约束。给出属性的定义,分析了属性应满足的性质。提出基于属性和任务的访问控制模型,模型中将代表用户工作的进程作为执行访问的直接主体,引入包含任务和任务状态信息的任务步概念,使进程和权限相关的任务步的匹配关系成为权限使用的先决条件,将权限的使用限制在与任务相关的工作中。在模型的实施机制中引入义务概念,以支持动态的权限管理策略。工程应用表明,该模型可增强任务权限的使用控制,支持产品研发工作流的动态访问控制策略。

英文摘要：

To satisfy the requirements of permission assignment and utilization in product development workflow,the attribute concept was taken as the base to define,assign and use permissions mapping to tasks in workflow.Followed by the definition of attribute in access control area and the summarization of properties of attribute,an attribute and task based access control model was presented,which included two important elements of process and taskstep.A process on behalf of a user＇s work was taken as the direct subject of execute access,and a task-step concept included the information of task and its state was introduced to make the associated task-step matching be the prerequisite of permission use,which could use permissions in certain works for associating with tasks.A component named as obligation was defined for the implement mechanism to support some dynamic policies in permission administration.The application showed that the proposed model enhanced the control on permission utilizations and suited for access control in workflow for product development.