Authors:
Ricardo Martinho
1
;
Dulce Domingos
2
and
António Rito-Silva
3
Affiliations:
1
School of Technology and Management, Polytechnic Institute of Leiria, Portugal
;
2
Faculty of Sciences, University of Lisbon, Portugal
;
3
INESC-ID Software Engineering Group, Technical University of Lisbon, Portugal
Keyword(s):
Workflow authentication requirements, authorization constraints, Role-based access control.
Related
Ontology
Subjects/Areas/Topics:
Enterprise Information Systems
;
Formal Methods
;
Information Systems Analysis and Specification
;
Methodologies and Technologies
;
Operational Research
;
Requirements Analysis And Management
;
Security
;
Simulation and Modeling
Abstract:
Workflow technology represents nowadays significant added value to organizations that use information systems to support their business processes. By their nature, workflows support the integration of different information systems. As organizations use workflows increasingly, workflows manipulate more valuable and sensitive data. Either by interoperability issues or by the value of data manipulated, a workflow may present several and distinct authentication requirements. Typically, information systems deal with their authentication requirements once, within their authentication process. This strategy cannot be easily applied to workflows since each workflow activity may present its own authentication requirements. In this paper we identify authentication requirements that workflows present and we propose to meet these requirements by incorporating authentication constraints into workflow authorization definitions. With this purpose, we extend a generic Role-Based Access Control (RBAC
) model and we define an access control algorithm that supports and enforces authorization decisions constrained by authentication information.
(More)