![](bg8.png)
methodology to derive workflow access control
information from business process models.
Additionally, we show how this methodology can
also be used to derive authorization rules for
information systems that support the business.
Our approach reduces the effort required to
define the workflow access control because it can be
derived from business process and WARM models,
which are not developed, but only used with access
control purposes. Therefore, we ensure that
workflow authorization rules are directly related to
the business, instead of being added to the workflow
as an afterthought based on the application
perspective. Similarly, authorization rules for
information systems that implement business
process are related to the workflow process
definition and, consequently, to the business.
Finally, our approach also guarantees the least
privileged principle by ensuring that each role has
the needed authorizations to perform its functions
and no more.
We are evaluating and developing a prototype
implementation of our methodology in the context of
the COMBINE (COMponent-Based Interoperable
Enterprise system development) project funded by
the V Framework IST-1999-20893, where it is being
tested in more real situations.
REFERENCES
Atluri, V., & Huang, W. (1996). An authorization Model
for workflows. In Proceedings of the 5th European
symposium on research in computer security. Rome,
Italy, pp 44-64.
Bertino, E., Ferrari. E., & Atluri, V. (1999). The
specification and enforcement of authorization
constraint in workflow management systems. ACM
Transactions on Information and System Security, vol.
2, nº1, pp. 65-104.
Bittner, K., Spence, I., & Jacobson, I. (2002). Use Case
Modeling. Addison Wesley Professional.
Botha, R.A., & Eloff, J.H.P. (2001a). Designing Role
Hierarchies for Access Control In Workflow Systems.
In Proceedings of the 25th Annual International
Computer Software and Applications Conference
(COMPSAC'01), Chicago, Illinois.
Botha, R.A., & Eloff, J.H.P. (2001b). Separation of Duties
for Access Control in Workflow Environments. IBM
Systems Journal. vol. 40, no. 3, pp. 666-682.
Casati, F., Castano, S. & Fugini, M. (1999). Managing
Workflow Authorization Constraints through Active
Database Technology. Information Systems Frontiers,
3, 3.
Eriksson, H., & Penker, M. (2000). Business Modeling
with UML, Business Patterns at Work. John Wiley &
Sons.
Fernandez, E.B., & Hawkins, J.C. (November 1997).
Determining role rights from use cases. In Proceedings
of the 2nd ACM Workshop on Role-Based Access
Control, pp. 121-125.
Foote, B., & Yoder, J. (August 1998). Metadata and
Active Objects-Models. In Proceedings of the Fifth
Conference on Pattern Languages of Programs (PLOP
98). Illinois, USA.
Holbein, R., Teufel, S., & Bauknecht, K. (1996a). A
Formal Security Design Approach for Information
Exchange in Organisations. In proceedings of the 9th
annual IFIP TC11 WG11.3 working conference on
Database security IX : status and prospects. 267-285.
Holbein, R., Teufel, S., & Bauknecht, K. (1996b). The use
of business process models for security design in
organisations. In Proceedings of 20th International
Conference on Information Security (IFIP SEC96 TC
11), Samos, Greece, Chapman & Hall, London, UK,
13-22.
Hollingsworth, D. (1995). The Workflow Reference
Model. Document Number TC-00-1003. Issue 1.1.
Kandala, S., & Sandhu, R. (2001). Secure Role-Based
Workflow Models. In Proceedings of the 15th Annual
IFIP WG 11.3. Canada.
Kang, M., Park, J. & Froscher, J. (2001). Access Control
Mechanisms for Inter-Organizational Workflow. In
Proceedings of the 6th ACM Symposium on Access
Control Models and Technologies, Chantilly, VA, 66–
74.
Manolescu, D. (2001). Micro-workflow: a workflow
architecture supporting compositional object-oriented
software development. PhD Thesis. University of
Illinois at Urbana-Champaign.
Miller, J., Fan, M., Wu, S., Arpinar, I., Sheth, A. &
Kochut, K. (1999). Security for the METEOR
Workflow Management System. Technical Report
#UGA-CS-LSDIS-TR-99-010, University of Georgia,
33 pages.
Nitsche, U., Holbein, R., Morger, O., & Teufel, S. (1998).
Realization of a Context-Dependent Access Control
Mechanism on a Commercial Platform. In Proceedings
of the 14th Int. Information Security Conf. IFIP/Sec'98,
part of the 15th IFIP World Computer Congress, pp
160-170.
Sandhu, R., Coyne, E., Feinstein, H. & Youman, C.
(1996). ‘Role-Based Access Control Models’. IEEE
Computer, vol. 29, no. 2.
Sharp, A., & McDermott, P. (2002). Workflow Modeling:
Tools for Process Improvement and Application
Development. Artech House.
Thomas, R., & Sandhu, R. (1997). Task-based
Authorization Controls (TBAC): A Family of Models
for Active and Enterprise-oriented Authorization
Management. In proceedings of the IFIP WG11.3
Workshop on Database Security, Lake Tahoe,
California.
Vieira, P., & Rito-Silva, A. (2003). Work Analysis
Refinement Modeling. INESC-ID Technical Report.
WORKFLOW ACCESS CONTROL FROM A BUSINESS PERSPECTIVE
25