Privacy-Aware Workflow Management

Abstract

Abstract. Information security policies play an important role in achieving information security. Confidentiality, Integrity, and Availability are classic information security goals attained by enforcing appropriate security policies. Workflow Management Systems (WfMSs) also benefit from inclusion of these policies to maintain the security of business-critical data. However, in typical WfMSs these policies are designed to enforce the organisation's security requirements but do not consider other external security requirements. Privacy is an important security requirement that concerns the subject of data held by an organisation. WfMSs often process sensitive data related to subjects who demand that their data is properly protected, but WfMSs fail to enforce the subjects' privacy desire due to their inability to capture and enforce privacy policies. In this paper, we illustrate existing WfMS privacy weaknesses and introduce the WfMS extensions required to enforce data privacy. We implemented the extensions in the YAWL WfMS environment and present a case study to demonstrate how our extended WfMS enforces a subject's privacy policy.

Purpose-based Versus Flow-Based Access Control for Privacy

“…12. Alhaqbani et al, 2009) Suppose that the Service-Update agent decides to use incoming PII in another application, such as datamining software (e.g., for research purposes). Simply, the agent can do this only if the flow system shown in Fig.…”

“…Proprietor role in access control: Alhaqbani et al (2009) used an example from the banking sector to illustrate a workflow model, shown in Fig. 14 (also Alhaqbani, 2010). The banking workflow model receives and processes customer requests and queries.…”

“…The solution offered by Alhaqbani et al (2009) is a conceptual OR model designed to enforce user privacy policies in workflow systems. Figure 15 shows a partial view of this solution.…”

Institutional Violence Complaints in Argentina: A Privacy Study

“…In this regards, in [5] authors showed weaknesses of WfMSs to capture and enforce privacy policies such as conflict of interest, hiding personal data, or generalizing data, and provide extensions to the YAWL WfMS to cope with such issues. Similarly, Mülle et al [6] and Ciuciu et.…”

A Data-Centric Approach for Privacy-Aware Business Process Enablement

“…In [17] a subject notion is introduced that is added to the workflow design; the subject is the user. The workflow management system can then access the subject attribute, and from that retrieve the user's privacy policy and thus can enforce the privacy policies of the user in the workflow.…”