Access control mechanisms for inter-organizational workflow

ABSTRACT

As more businesses engage in globalization, inter-organizational collaborative computing grows in importance. Since we cannot expect homogeneous computing environments in participating organizations, heterogeneity and Internet-based technology are prevalent in inter-organizational collaborative computing environments. One technology that provides solutions for data sharing and work coordination at the global level is inter-organizational workflow. In this paper, we investigate the access control requirements for inter-organizational workflow. We then present access control solutions for inter-organizational workflow based on our implementation. Many of the requirements and solutions in this paper address the scalability of existing security solutions, the separation of inter-organizational workflow security from concrete organization level security enforcement, and the enforcement of fine-grained access control for inter-organizational workflow.

REFERENCES

• 1: "Extensible Markup Language (XML) 1.0," World-wide- Web Consortium, http://www.w3.org/TR/1998/REC-xml- 19980210.html.
• 2: Gerard J. Holzmann, The Model Checker SPIN, IEEE Transactions on Software Engineering, v.23 n.5, p.279-295, May 1997 [doi>10.1109/32.588521]
• 3: Myong H. Kang , Judith N. Froscher , Amit P. Sheth , Krys Kochut , John A. Miller, A Multilevel Secure Workflow Management System, Proceedings of the 11th International Conference on Advanced Information Systems Engineering, p.271-285, June 14-18, 1999
• 4: Myong H. Kang , Brian J. Eppinger , Judith N. Froscher, Tools to Support Secure Enterprise Computing, Proceedings of the 15th Annual Computer Security Applications Conference, p.143, December 06-10, 1999
• 5: Douglas L. Long , Julie Baker , Francis Fung, A Prototype Secure Workflow Server, Proceedings of the 15th Annual Computer Security Applications Conference, p.129, December 06-10, 1999
• 6: K. Kochut, A. Sheth, and J. Miller, "ORBWork: A CORBA- Based Fully Distributed, Scalable and Dynamic Workflow Enactment Service for METEOR," UGA-CS-TR-98-006, Technical Report, Department of Computer Science, University of Georgia, 1998.
• 7: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 8: R. Simon and M. E. Zurko, "Separation of Duty in Role- Based Access Control Environments," In Proceedings of New Security Paradigms Workshop, September 1997.
• 9: D. F. Sterne, G. W. Tally, C. D. McDonell, D. L. Sherman, D. L. Sames, and P. X. Pasturel, "Scalable Access Control for Distributed Object Systems," In Proceedings of 8 th USENIX Security Symposium, Washington, DC, August 1999.
• 10: Roshan K. Thomas , Ravi S. Sandhu, Task-Based Authorization Controls (TBAC): A Family of Models for Active and Enterprise-Oriented Autorization Management, Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects, p.166-181, August 10-13, 1997
• 11: H.M.W. Verbeek, T. Basten, and W.M.P. van der Aalst. Diagnosing Workflow Processes using Woflan. Computing Science Report 99/02, Eindhoven University of Technology, Eindhoven, 1999.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.3 Group and Organization Interfaces
          Subjects: Collaborative computing

  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.8 Problem Solving, Control Methods, and Search
          Subjects: Control theory

  J. Computer Applications
  J.1 ADMINISTRATIVE DATA PROCESSING
      Subjects: Business

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

General Terms:
Design, Management, Performance, Security, Theory

Keywords:
access control, enterprise, organizational security, security, workflow