Patent ID: 8099509
Filing Date: 2012-01-17
Classification: G06F,G06Q,H04L

Abstract:
1. A workflow execution system for executing based on a workflow operations to a plurality of resources connected to a network, comprising: approval request means which retrieves each operation from the workflow to be executed, and outputs an access request for said each operation retrieved, said access request including information of a target resource for said each operation, content information of said each operation, and requester identification information of a request for approval, to thereby issue an inquiry whether said each operation is permitted or denied; access-control-rule application means which refers to a database storing therein one or more access control rules, the one or more access control rules each describing an access permission/denial attribute for a combination including: (a) identification information of a target resource for access, (b) content information of operation to resource, (c) user identification information, and (d) requester identification information, judges in a judgment whether said access request is to be permitted or denied based on said one or more access control rules, wherein if said access-control-rule application means can decide permission or denial based on the access control rules currently stored in said database, said access-control-rule application means outputs a judgment result based on the currently stored access control rules; and if said access permission/denial attribute of the access control rules currently stored in said database is a manual approval, said access-control-rule application means requests an external judgment by a resource administrator specifying whether said access request is to be permitted or denied, and outputs a result of said external judgment; and operation execution means which performs said each operation to resource based on said workflow after an access permission for all of the operations is obtained from said access-control-rule application means, wherein said access-control-rule application means stores said result of said external judgment into said database as a new access control rule.