MS Olivier, RP van de Riet and E Gudes "Specifying Application-level Security in Workflow Systems," in R Wagner (ed), Proceedings of the Ninth International Workshop on Security of Data Intensive Applications (DEXA 98), 346-351, IEEE, 1998
A workflow process involves the execution of a set of related activities over time to perform a specific task. Security requires that such activities may only be performed by authorised subjects. In order to enforce such requirements, access to the underlying data objects has to be controlled. We refer to such access control as level 1 access control. In addition, when an individual is authorised to perform an activity, access should be limited to the time that the activity is being performed: Access to activity information before an activity commences or after it has terminated may be undesirable. This we will refer to as level 2 security. Finally, applications often specify application-oriented (level 3) security requirements. This paper considers security restrictions in the latter category and proposes a rigorous approach that may be used to specify such policies. Enforcement (implementation) of such policies is also considered. The paper assumes that level 1 and level 2 mechanisms are in place and builds level 3 security mechanisms on these underlying levels.
Workflow systems, Security
@INPROCEEDINGS(appwf,
AUTHOR={Martin S Olivier and Reind P van de Riet and Ehud Gudes},
TITLE={Specifying Application-level Security in Workflow Systems},
EDITOR={R Wagner},
BOOKTITLE={Proceedings of the Ninth International Workshop on
Security of Data Intensive Applications (DEXA 98)},
PAGES={346--351},
PUBLISHER={IEEE},
YEAR={1998} )
The full text may be downloaded from http://mo.co.za/ask/appwf.pdf (PDF, 57K) (©IFIP).
Note that a username and password are required to download the full text. (Why?) Please e-mail me and I will send you a username and password.
[Publications]
[Home]
Page maintained by
Martin Olivier
Last update: February 5, 2002