Flexible authorisation in dynamic e-business environments using an organisation structure-based access control model

Abstract

In dynamic e-business and e-manufacturing environments, enterprises require a secure access control mechanism based on an access control model to manage employee authorisations flexibly. This study presents an organisation structure-based access control (OSAC) model based on a task-role-based access control (T-RBAC) model. The OSAC model emphasises that employee authorisations are generated directly based on their position in the enterprise organisational structure. The proposed model extends the concepts of static separation of duty (SSD), dynamic separation of duty (DSD), prerequisite, and cardinality constraints in the role-based access control (RBAC) model to present department and role relations that identify the cooperative interactive relations among roles across department boundaries to facilitate resource sharing among roles and simplify enterprise resource management. Various relations and applied examples are demonstrated using the class model in unified modelling language (UML). Examples of inappropriate use of relations that lead to violation of relation are also presented. To demonstrate the feasibility of the proposed model for most businesses, a case study involving an automobile component producer is presented and an OSAC model-based administrative management system is developed to ensure that appropriate resources can be legally used by the correct employees and at the right time. By applying the proposed model, administrators can easily manage resources based on an organisational structure perspective and the resource sharing capabilities of all departments can be improved.