An Authorization and Access Control Model for Workflow

Sodki Chaari, Chokri Ben Amar, Frederique Biennier, Joel Favrel

2004

Abstract

A workflow is a coordinated arrangement of related tasks in an automated process, the systematic execution of which, ultimately achieves some goal. Workflow Management Systems (WFMSs) are becoming very popular and are being used to support many of the day to day workflows in large organizations. Security is an essential and fundamental part of workflows, the WFMS has to manage and execute the workflows in a secure way. Security, in a workflow context, involves the implementation of access control security mechanisms to ensure that tasks are performed by authorized subjects only. In this paper we propose a workflow authorization model capable of specifying authorization in such a way that subjects gain access to required objects only during the execution of the task. We build our model over the well known RBAC framework, and that in addition extends RBAC by including new rules in order to be adaptable with workflow context.

References

  1. Atluri, V., Huang, W.-K., Bertino, E.: An Execution Model for Multilevel Secure Workflows, in Proceedings of the 11th IFIP Working Conference on Database Security (1997) 151-165
  2. Bertino, E., Ferrari, E., Atluri, V.: An Approach for the Specification and Enforcement of Authorization Constraints in Workflow Management Systems, ACM Transactions on Information Systems Security, Vol 1, No 1 (1999)
  3. Ferraiolo David, F., Richard Kuhn, D., Cugini, J.: A. Role Based Access Control: Features and Motivations In Proceedings of Computer Security Applications Conference (1995)
  4. Georgakopoulos, D., Hornick, M., Sheth, A.: An Overview of Workflow Management: From Process Modelling to Workflow Automation Infrastructure. Distributed and Parallel Databases (1995) 119 -153
  5. Krishnakumar, N., Sheth, A.: Managing Heterogeneous Multi-system Tasks to Support Enterprise-wide Operations. The Journal on Distributed and Parallel Database Systems, 3 (2) (1995)
  6. Sandhu, R.: Engineering Authority and Trust in Cyberspace: The OM-AM and RBAC Way. Fifth ACM Workshop on RBAC (2000) 111 - 119
  7. Shengli, W., Zongwei L.: Authorization and Access Control of Application Data in Workflow Systems, Journal of Intelligent Information Systems, 18 (1), Kluwer Academic Publishers (2002) 71-94
  8. Valia, R., Al-Salqan, Y.: Secure workflow environment. In: Sixth IEEE Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (1998) 269 - 276
  9. Workflow Management Coalition (WfMC): Workflow Security Considerations White Paper, Document Number WFMC-TC- 1019, Document Status - Issue 1.0 (2001)
Download


Paper Citation


in Harvard Style

Chaari S., Ben Amar C., Biennier F. and Favrel J. (2004). An Authorization and Access Control Model for Workflow . In Proceedings of the 1st International Workshop on Computer Supported Activity Coordination - CSAC, (ICEIS 2004) ISBN 972-8865-08-2, pages 31-40. DOI: 10.5220/0002663400310040


in Bibtex Style

@conference{csac04,
author={Sodki Chaari and Chokri Ben Amar and Frederique Biennier and Joel Favrel},
title={An Authorization and Access Control Model for Workflow},
booktitle={Proceedings of the 1st International Workshop on Computer Supported Activity Coordination - CSAC, (ICEIS 2004)},
year={2004},
pages={31-40},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002663400310040},
isbn={972-8865-08-2},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 1st International Workshop on Computer Supported Activity Coordination - CSAC, (ICEIS 2004)
TI - An Authorization and Access Control Model for Workflow
SN - 972-8865-08-2
AU - Chaari S.
AU - Ben Amar C.
AU - Biennier F.
AU - Favrel J.
PY - 2004
SP - 31
EP - 40
DO - 10.5220/0002663400310040