使用XML設計執行權管制資訊流

Abstract

隨著企業內網路的盛行，負責企業內部控制的執行權管制系統就顯得格外重要，在傳統的執行權管制系統中，執行權管制資訊無法直接在不同作業平台上共用，造成資訊重複、維護成本提高的問題。以角色為基礎的執行權管制 (Role-Based Access Control，RBAC) 近年來被視為能符合企業組織需求的執行權管制政策，因此本研究以RBAC為執行權管制政策，以Web應用程式為展示環境，探討如何使用XML設計執行權管制資訊，以及使用XML Schema定義XML文件。藉著XML可延伸以及跨平台的特性，使資訊得以流通於各作業平台。最後以核保業務的執行權管制資訊作為實例探討，並提出一個Web應用程式架構，提供將核保作業實現在Web瀏覽器環境的參考。

Although an increasing number of companies have their own intranet systems, each system has its own access control information. Conventional intranet systems are unable to share their access control information with others from different operating platforms. The redundancy of access control information reduces efficiency. In this thesis, the author presents a novel scheme, which enables various operating platforms to utilize the same access control information. The extensibility and inter-operability of access control information is due to a design based upon XML standardization, in particular, W3C XML Schema. A system architecture is presented to show how the concept be applied to web applications. As a detail example, access control information for insurance underwriting is presented as a case study.