The specification and enforcement of authorization constraints in workflow management systems

Abstract

In recent years, workflow management systems (WFMSs) have gained popularity in both research and commercial sectors. WFMSs are used to coordinate and streamline business processes. Very large WFMSs are often used in organizations with users in the range of several thousands and process instances in the range of tens and thousands. To simplify the complexity of security administration, it is common practice in many businesses to allocate a role for each activity in the process and then assign one or more users to each role—granting an authorization to roles rather than to users. Typically, security policies are expressed as constraints (or rules) on users and roles; separation of duties is a well-known constraint. Unfortunately, current role-based access control models are not adequate to model such constraints. To address this issue we (1) present a language to express both static and dynamic authorization constraints as clauses in a logic program; (2) provide formal notions of constraint consistency; and (3) propose algorithms to check the consistency of constraints and assign users and roles to tasks that constitute the workflow in such a way that no constraints are violated.

A template-based approach for responsibility management in executable business processes

“…Resource assignment languages (van der Aalst and ter Hofstede 2005; Cabanillas et al 2015b; Bertino, Ferrari, and Atluri 1999; Strembeck and Mendling 2011; Casati et al 1996; Scheer 2000; Du et al 1999; Tan, Crampton, and Gunter 2004; Cabanillas et al 2015a; Wolter and Schaad 2007; Awad et al 2009; Stroppi, Chiotti, and Villarreal 2011) serve the former purpose by enabling the definition of the conditions that the members of an organisation must meet in order to be allowed to participate in the activities of the processes executed in it, e.g., to belong to a specific department or to have certain skills. The outcome is a resource-aware process model .…”

Role-Based Privilege Management Using Attribute Certificates and Delegation

“…A number of researchers have looked at the semantics of authorization, delegation, and revocation. Li et al proposed a logic for authorizing delegation in large-scale, open, distributed systems [3,10]. But in their logic, role-based concepts were not fully adopted; neither did they address revocation adequately.…”

A Formal Framework for Adaptive Access Control Models

“…Controlled access to its application services as well as to the application objects managed by them (e.g., business processes, documents, resources, or application systems) constitutes an important task for any information system (IS) [4,5,6,7,8]. This results in a large number of access rules covering different system aspects and user privileges [9].…”

“…In the literature numerous approaches have been presented dealing with challenging issues related to access control (e.g., [12,20,21,22]). Most of these approaches apply Role-Based Access Control (RBAC) models for defining and managing user privileges [6,23,20,24], e.g., to control the access to business documents and database objects, or to resolve the set of actors that qualify for a newly activated task in a workflow system [25,4,8,21,26,22].…”

“…Regarding workflow-based applications, in addition, dynamic constraints (e.g., separation of duties) were extensively investigated in the past [4,8,27,28]. Practical issues related to RBAC (e.g., NIST's proposed RBAC standard, integration of RBAC with enterprise IT infrastructures, RBAC in commercial products) are summarized in [24].…”