Security Constraints in Temporal Role-Based Access-Controlled Workflows (Extended Version)
This work addresses security and correctness in access-controlled workflows for domains like business or IT systems, but it appears incremental as it builds on existing models and algorithms.
The paper tackles the integration of workflows with role-based access control under temporal constraints, mapping them to temporal networks to determine authorized users per task and defining security constraints with propagation rules to prevent unauthorized actions.
Workflows and role-based access control models need to be suitably merged, in order to allow users to perform processes in a correct way, according to the given data access policies and the temporal constraints. Given a mapping between workflow models and simple temporal networks with uncertainty, we discuss a mapping between role temporalities and simple temporal networks, and how to connect the two resulting networks to make explicit who can do what, when. If the connected network is still executable, we show how to compute the set of authorized users for each task. Finally, we define security constraints (to prevent users from doing unauthorized actions) and security constraint propagation rules (to propagate security constraints at runtime). We also provide an algorithm to check whether a set of propagation rules is safe, and we extend an existing execution algorithm to take into account these new security aspects.