A Workflow-Based Access Control Framework for e-Health Applications

Abstract

In this paper, we present a framework where access rights are provided to entities on the basis of the actual task that the entities must fulfill as part of their duties. For capturing the requirements of entities' duties we use the notion of workflow. Our main aim is to provide an access control mechanism that is able to balance the competing goals of flexibility and security. As the main beneficiary of our approach we consider e-Health Applications, where flexibility and security are major requirements. We also provide an implementation of a medical case study to illustrate the framework.

A web service approach for integrating e-Health Data in a low bandwidth environment

“…Likewise, if the access control mechanism is too loose then protection of information and resource cannot be guaranteed. Therefore a precise access control mechanism is required that is able to deal with the level of unpredictability of typical healthcare application [16].…”

Towards an Access Control Model for Collaborative Healthcare Systems

“…Any subject in this role would be allowed the permissions associated with this role . Furthermore, RBAC does not consider healthcare provider workflow (Russello et al, 2008) nor separate task from role. Various types of tasks with different access control characteristics are dealt with in the same manner (Oh and Park, 2003).…”

“…Such models and extensions have been employed in specific applications to manage information access in a controlled environment. Nevertheless, few studies have addressed the issue of managing information access within the context of team collaboration (Thomas, 1997;Georgiadis et al, 2001;Alotaiby and Chen, 2004) and workflow (Le et al, 2012;Russello et al, 2008). This study, proposes an access control model that is secure, flexible, easy to manage, and supports cooperative engagements.…”

A privacy-aware access control model for distributed network monitoring

“…In this context, work in the area of access control enforcement in workflow management [34] [35] and Model-Driven Security [36][37], though important, suffer from enforcing security policies only at run-time and not during the workflow formation.…”