A Formal Framework for Adaptive Access Control Models

Abstract

Abstract. For several reasons enterprises are frequently subject to organizational change. Respective adaptations may concern business processes, but also other components of an enterprise architecture. In particular, changes of organizational structures often become necessary. The information about organizational entities and their relationships is maintained in organizational models. Therefore the quick and correct adaptation of these models is fundamental to adequately cope with organizational changes. However, model changes alone are not sufficient to guarantee consistency. Since organizational models also provide the basis for defining access rules (e.g., actor assignments in workflow management systems or access rules in document-centered applications) this information has to be adapted accordingly (e.g., to avoid dangling references or non-resolvable actor assignments). Current approaches do not adequately address this problem, which often leads to security gaps and delayed change implementation.In this paper we introduce a formal framework for the controlled evolution of organizational models and related access rules. Firstly, we introduce a set of operators with well-defined semantics for defining and changing organizational models. Secondly, we show how to define access rules based on such models. In this context we also define a notion of correctness for access rules. Thirdly, we present a formal framework for the (semi-automated) adaptation of access rules when the underlying organizational model is changed by exploiting the semantics of the applied changes. Altogether the presented approach provides an important contribution for realizing adaptive access control frameworks.

Flexibility in Process-Aware Information Systems

“…In this context, we are developing intelligent analysis techniques to learn from process changes [49][50][51]. Finally, we are currently working on issues related to the dynamic adaptation of organizational rules and access constraints [52,53], to process variant management [54], and to process model refactoring [55].…”

Managing the Life Cycle of Access Rules in CEOSIS

“…As a consequence, task assignment is handled outside the system and thus might be not properly documented. Furthermore, manual task assign- In [10,11] we presented an approach for specifying organizational models and for propagating changes of such models to access rules. In particular, such adaptations become necessary to maintain correctness and consistency of access rules; e.g., avoiding the situation where no actor qualifies for a specific access rule anymore.…”

“…In this paper, we use a well-established, but rather simple organizational meta model OMM to focus on core issues related to access rule changes. In principle, OMM and the subsequent considerations can be transferred to more complex organizational meta models as well (e.g., capturing entities such as abilities or substitution relations) [11].…”

“…To be able to analyze the effects of changes of an organizational model we introduced respective change operations with precise formal semantics in [10,11]. Similarly, in this section, we define operations for changing access rules directly; e.g., deleting AND-terms.…”

“…Organizational Change: Access rule adaptations might become necessary after changes of organizations and organizational models respectively [10,11]. Assume that access control within a PAIS (i.e., the assignment of work items to users) is reflected by the simple access rules depicted in Fig.…”