PRES: a practical flexible RBAC workflow system

ABSTRACT

Web-based workflow can be used to facilitate enterprise business process while the security and flexibility are two of the most important aspects in electronic business system. RBAC is regarded as a neutral policy and has been the most popular secure model in recent years. The flexible RBAC workflow model (FRWM) has been proposed recently. It has encapsulated RBAC and workflow together considering both security and flexibility features. In this paper the enforcement of FRWM is introduced. We also present the design and implementation of a practical system for Property Right Exchange (PRES) based on FRWM, in which the flexibility of workflow can be reached through definition and execution while considering the security with RBAC.

REFERENCES

• 1: Gail-Joon Ahn , Ravi Sandhu , Myong Kang , Joon Park, Injecting RBAC to secure a Web-based workflow system, Proceedings of the fifth ACM workshop on Role-based access control, p.1-10, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344295]
• 2: Elisa Bertino , Elena Ferrari , Vijayalakshmi Atluri, A flexible model supporting the specification and enforcement of role-based authorization in workflow management systems, Proceedings of the second ACM workshop on Role-based access control, p.1-12, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266746]
• 3: Elisa Bertino , Elena Ferrari , Vijay Atluri, The specification and enforcement of authorization constraints in workflow management systems, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.65-104, Feb. 1999 [doi>10.1145/300830.300837]
• 4: Elisa Bertino , Piero Andrea Bonatti , Elena Ferrari, TRBAC: A temporal role-based access control model, ACM Transactions on Information and System Security (TISSEC), v.4 n.3, p.191-233, August 2001 [doi>10.1145/501978.501979]
• 5: Li Hong-Chen, Shi Mei-Lin, "Workflow Models and Their Formal Descriptions", Chinese Journal of Computer, Vol. 26 No. 11, Nov. 2003, 1456--1463
• 6: Gao Jing, Zhu Ge, "The Status and Problem of Property Rights Trade Market in China", management of Science ology and technology, 2003, 14(6):1052--1059
• 7: Ge Sheng, Sun Ying-Lin, Huai Jin-Peng, "A Role Base Software Collaboration Environment", Journal of Computer Research And Development, Vol. 40, No. 5,
• 8: J. J. Halliday , S. K. Shrivastava , S. M. Wheater, Flexible Workflow Management in the OPENflow System, Proceedings of the 5th IEEE International Conference on Enterprise Distributed Object Computing, p.82, September 04-07, 2001
• 9: Petra Heinl , Stefan Horn , Stefan Jablonski , Jens Neeb , Katrin Stein , Michael Teschke, A comprehensive approach to flexibility in workflow management systems, Proceedings of the international joint conference on Work activities coordination and collaboration, p.79-88, February 22-25, 1999, San Francisco, California, United States
• 10: R. Holbein, S. Teufel, "A Context Authentication Service for Role-based Accedd Control in Distributed System - CARDS". In Proceeding of IFIP 11th International Conference on Information Security. 1995
• 11: K. M. Jackson , J. Hruska , Donn B. Parker, Computer security reference book, CRC Press, Inc., Boca Raton, FL, 1992
• 12: James B. D. Joshi , Basit Shafiq , Arif Ghafoor , Elisa Bertino, Dependencies and separation of duty constraints in GTRBAC, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775420]
• 13: James B. D. Joshi, etc "Generalized temporal role based access control model (GTRBA) (Part I)- specification and modeling", CERIS TR 2001-47, Purdue University
• 14: P. J. Mangan and S. Sadiq, A constraints specification approach to building flexible workflows. Journal of Research and Practice in Information Technology, 2002
• 15: Peter Mangan , Shazia Sadiq, On building workflow models for flexible processes, Proceedings of the thirteenth Australasian database conference, p.103-109, January 01, 2002, Melbourne, Victoria, Australia
• 16: Michael Zur Muehlen, Organizational Management in Workflow Applications – Issues and Perspectives, Information Technology and Management, v.5 n.3-4, p.271-291, July-October 2004 [doi>10.1023/B:ITEM.0000031582.55219.2b]
• 17: Sejong Oh , Seog Park, Task-Role Based Access Control (T-RBAC): An Improved Access Control Model for Enterprise Environment, Proceedings of the 11th International Conference on Database and Expert Systems Applications, p.264-273, September 04-08, 2000
• 18: Sejong Oh , Seog Park, An Integration Model of Role-Based Access Control and Activity Based Access Control Using Task, Proceedings of the IFIP TC11/ WG11.3 Fourteenth Annual Working Conference on Database Security: Data and Application Security, Development and Directions, p.355-360, August 21-23, 2000
• 19: Richard Power , Rik Farrow, Tangled Web: Tales of Digital Crime from the Shadows of Cyberspace, Macmillan Press Ltd., Basingstoke, UK, 2000
• 20: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 21: Ravi Sandhu , David Ferraiolo , Richard Kuhn, The NIST model for role-based access control: towards a unified standard, Proceedings of the fifth ACM workshop on Role-based access control, p.47-63, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344301]
• 22: Thomas, R. K. and Sandhu R., "Task-based suthorization controls(TBAC)" proceedings of Computer Fondations Workshop X, 1997
• 23: Jacques Wainer , Fabio Bezerra , Paulo Barthelmess, Tucupi: a flexible workflow system based on overridable constraints, Proceedings of the 2004 ACM symposium on Applied computing, March 14-17, 2004, Nicosia, Cyprus [doi>10.1145/967900.968003]
• 24: WFMC. "Workflow Management Coalition: Terminology & Glossary". WFMC-TC-1011, 1999.2. Http://www.wfmc.org}
• 25: Zhao W., Hu WH, Zhang SK, Wang LF. "Study and Application of a workflow meta-model". Journal of Software, 2003, 14(6):1052--1059
• 26: Y. Q. SUN, etc "An Approach For Flexible RBAC Workflow System", Proceeding of 9th International Conference on Computer Supported Cooperative Work in Design (CSCWD 2005), Coventry, May, 2005 (accepted)

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

Additional Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.1 Office Automation

General Terms:
Design, Security

Keywords:
RBAC, electronic business, property right exchange, workflow