Skip to main content
SpringerLink
Log in

Using colored Petri nets to model and analyze workflow with separation of duty constraints

  • ORIGINAL ARTICLE
  • Published:
The International Journal of Advanced Manufacturing Technology Aims and scope Submit manuscript

Abstract

Workflow provides a promising solution for organizations to achieve their business goals by interactions and collaborations between users. Separation of duty (SoD) is a security principle to prevent fraud and errors in collaborative workflow environments. It is crucial to verify and ensure the correctness and consistence of workflow with SoD constraints during the design time. In this paper, we propose a method to model and analyze workflow with SoD constraints based on colored Petri nets (CPN). The control flow, authorization rules and SoD constraints in a workflow are all represented by CPN and combined into one integrated CPN model. Then the execution paths of this model can be derived by reachability tree analysis. By analyzing these execution paths, some latent deadlocks caused by the inconsistency between authorization rules and SoD constraints can be detected.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

References

  1. WfMC (1995) Workflow management coalition: The workflow reference model. WF-TC00-1003, January, 1995

  2. WfMC (1998) Workflow security considerations - white paper. WF-TC-1019, Febrary, 1998

  3. Clark DD, Wilson DR (1997) A comparison of commercial and military computer security policies. In: Proceedings of IEEE Symposium on Security and Privacy, Oakland, USA, April, 1987, pp 184–195

  4. Sandhu RS (1990) Separation of duties in computerized information systems. In: Proceedings of IFIP WG11.3 Workshop on Database Security, Halifax, UK, September, 1990, pp 179–190

  5. Murata T (1989) Petri nets: properties, analysis and applications. Proc IEEE 77(4):541–580

    Article  Google Scholar 

  6. Jensen K (1992) Coloured Petri nets - basic concepts, analysis methods and practical use. Volume 1, EATCS Monographs on Theoretical Computer Science, Springer, Berlin Heidelberg New York

  7. van der Aalst WMP (1998) The application of Petri nets to workflow management. J Circuits Syst Comput 8(1):21–66

    Article  Google Scholar 

  8. Adam NR, Atluri V, Huang WK (1998) Modeling and analysis of workflows using Petri nets. J Intell Inf Syst 10(2):131–158

    Article  Google Scholar 

  9. Dong M, Chen FF (2005) Petri net-based workflow modelling and analysis of the integrated manufacturing business processes. Int J Adv Manuf Tech 26(9/10):1163–1172

    Article  Google Scholar 

  10. Atluri V, Huang WK (1996) An authorization model for workflows. In: Proceedings of the Fourth European Symposium on Research in Computer Security, Rome, Italy, September, 1996, pp 44–64

  11. Thomas RK, Sandhu RS (1997) Task-based authorization controls (TBAC): A family of models for active and enterprise-oriented authorization management. In: Proceedings of the IFIP WG11.3 Workshop on Database Security, Lake Tahoe, California, USA, August, 1997, pp 166–181

  12. Knorr K (2000) Dynamic access control through Petri net workflows. In: Proceedings of the 16th Annual Computer Security Applications Conference, New Orleans, USA, December, 2000, pp 159–167

  13. Wu SL, Sheth A, Miller J, Luo ZW (2002) Authorization and access control of application data in workflow systems. J Intell Inf Syst 18(1):71–94

    Article  Google Scholar 

  14. Atluri V, Huang WK (2000) A Petri net-based safety analysis of workflow authorization models. J Comput Secur 8(2/3):209–240

    Google Scholar 

  15. Bertino E, Ferrari E, Atluri V (1999) An authorization model for supporting the specification and enforcement of authorization constraints in workflow management systems. ACM T Inform Syst Secur 2(1):65–104

    Article  Google Scholar 

  16. Knorr K, Weidner H (2001) Analyzing separation of duties in Petri net workflows. In: Proceedings of Information Assurance in Computer Networks, Petersburg, Russia, May, 2001, pp 102–114

  17. Liu DR, Wu MR, Lee ST (2004) Role-based authorizations for workflow systems in support of task-based separation of duty. J Syst Software 73(3):375–387

    Article  Google Scholar 

  18. Oh S, Park S (2003) Task-role-based access control models. Inform Syst 28(6):533–562

    Article  MATH  Google Scholar 

  19. Fung RYK, Au YM, Jiang ZB, Lau HCW (2003) Supply chain workflow modelling using XML-formatted modular Petri nets. Int J Adv Manuf Tech 22(7–8):587–601

    Article  Google Scholar 

  20. Yang N, Lou ZL, Zhou XH (2005) Petri net-based workflow modeling for a die and mould manufacturing resource planning system. Int J Adv Manuf Tech 26(4):366–371

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Key Laboratory for Information System Security, Ministry of Education China, School of Software, Tsinghua University, Beijing, 100084, People’s Republic of China

    Yahui Lu, Li Zhang & Jiaguang Sun

  2. Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, People’s Republic of China

    Yahui Lu & Jiaguang Sun

Authors
  1. Yahui Lu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Li Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jiaguang Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yahui Lu.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Lu, Y., Zhang, L. & Sun, J. Using colored Petri nets to model and analyze workflow with separation of duty constraints. Int J Adv Manuf Technol 40, 179–192 (2009). https://doi.org/10.1007/s00170-007-1316-1

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00170-007-1316-1

Keywords

Search

Navigation