Delegation and satisfiability in workflow systems

ABSTRACT

Supporting delegation mechanisms in workflow systems is receiving increasing interest from the research community. An important requirement of a constrained workflow is to guarantee the satisfiability of the workflow, which requires that some set of authorized users can complete a workflow. Typically, any mechanism that is used to establish the satisfiability of a workflow is based on the workflow specification and the user authorization information. The effect of a successful user delegation request is to change the user authorization information, thereby affecting the satisfiability of the workflow.

Existing work on delegation in workflows does not consider the satisfiability of the workflow. In this paper, we address the satisfiability problem of workflows, while supporting user delegation mechanisms, in the context of three different workflow execution models. We consider delegation of concrete tasks, abstract tasks and roles. We present algorithms for evaluating various delegation requests in each workflow execution model.

REFERENCES

• 1: Atluri, V., Bertino, E., Ferrari, E., and Mazzoleni, P. Supporting delegation in secure workflow management systems. In Proceedings of 17th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (2003), pp. 190--202.
• 2: Vijayalakshmi Atluri , Janice Warner, Supporting conditional delegation in secure workflow management systems, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1063990]
• 3: Jason Crampton, A reference monitor for workflow systems with constrained task execution, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1063986]
• 4: Crampton, J. Personal communication to Ninghui Li, November 2006.
• 5: Jason Crampton , Hemanth Khambhammettu, Delegation in role-based access control, International Journal of Information Security, v.7 n.2, p.123-136, March 2008 [doi>10.1007/s10207-007-0044-8]
• 6: Jason Crampton , Hemanth Khambhammettu, On delegation and workflow execution models, Proceedings of the 2008 ACM symposium on Applied computing, March 16-20, 2008, Fortaleza, Ceara, Brazil [doi>10.1145/1363686.1364199]
• 7: Downey, R., and Fellows, M. Parameterized Complexity. Springer, 1999.
• 8: Savith Kandala , Ravi Sandhu, Secure role-based workflow models, Proceedings of the fifteenth annual working conference on Database and application security, p.45-58, July 15-18, 2001, Niagara, Ontario, Canada
• 9: Venter, K., and Olivier, M. The delegation authorization model: A model for the dynamic delegation of authorization rights in a secure workflow management system. In Proceedings of Information Security South Africa (2002). Published electronically. Available at http://icsa.cs.up.ac.za/issa/2002/proceedings/A021.pdf.
• 10: Jacques Wainer , Akhil Kumar , Paulo Barthelmess, DW-RBAC: A formal security model of delegation and revocation in workflow systems, Information Systems, v.32 n.3, p.365-384, May, 2007 [doi>10.1016/j.is.2005.11.008]
• 11: Wang, Q., and Li, N. Satisfiability and resiliency in workflow systems. In Proceedings of 12th European Symposium On Research In Computer Security (2007), vol. 1146 of LNCS, pp. 90--115.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.1 Office Automation
          Subjects: Workflow management

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Security

Keywords:
delegation, satisfiability, workflow management systems