Business & Information Systems Engineering

, Volume 6, Issue 4, pp 215–237

Modeling Support for Role-Based Delegation in Process-Aware Information Systems

Research Paper
  • 230 Downloads

Abstract

In the paper, an integrated approach for the modeling and enforcement of delegation policies in process-aware information systems is presented. In particular, a delegation extension for process-related role-based access control (RBAC) models is specified. The extension is generic in the sense that it can be used to extend process-aware information systems or process modeling languages with support for process-related RBAC delegation models. Moreover, the detection of delegation-related conflicts is discussed and a set of pre-defined resolution strategies for each potential conflict is provided. Thereby, the design-time and runtime consistency of corresponding RBAC delegation models can be ensured. Based on a formal metamodel, UML2 modeling support for the delegation of roles, tasks, and duties is provided. A corresponding case study evaluates the practical applicability of the approach with real-world business processes. Moreover, the approach is implemented as an extension to the BusinessActivity library and runtime engine.

Keywords

Access control Business processes Delegation Duties RBAC Security 

Supplementary material

12599_2014_343_MOESM1_ESM.pdf (408 kb)
(PDF 408 kB)

References

  1. Atluri V, Warner J (2005) Supporting conditional delegation in secure workflow management systems. In: Proceedings of the 10th ACM symposium on access control models and technologies (SACMAT), pp 49–58 Google Scholar
  2. BAL (2012) Business activity library and runtime engine. http://wi.wu.ac.at/home/mark/BusinessActivities/library.html. Accessed 2012-09-24
  3. Barka E, Sandhu R (2000a) A role-based delegation model and some extensions. In: Proceedings of the 23rd national information systems security conference (NISSEC) Google Scholar
  4. Barka E, Sandhu R (2000b) Framework for role-based delegation models. In: Proceedings of the 16th annual computer security applications conference (ACSAC) Google Scholar
  5. Basin D, Doser J, Lodderstedt T (2006) Model driven security: from UML models to access control Infrastructure. ACM Transactions on Software Engineering and Methodolocy 15(1):39–91 CrossRefGoogle Scholar
  6. Botha RA, Eloff JH (2001) Separation of duties for access control enforcement in workflow environments. IBM Systems Journal 40(3):666–682 CrossRefGoogle Scholar
  7. Casati F, Castano S, Fugini M (2001) Managing workflow authorization constraints through active database technology. Information Systems Frontiers 3(3):319–338 CrossRefGoogle Scholar
  8. Cole J, Derrick J, Milosevic Z, Raymond K (2001) Author obliged to submit paper before 4 July: policies in an enterprise specification. In: Proceedings of the International workshop on policies for distributed systems and networks (POLICY), pp 1–17 CrossRefGoogle Scholar
  9. Corbin J, Strauss A (2008) Basics of qualitative research: techniques and procedures for developing grounded theory. Sage, Thousand Oaks Google Scholar
  10. Crampton J, Khambhammettu H (2008a) Delegation and satisfiability in workflow systems. In: Proceedings of the 13th ACM symposium on access control models and technologies (SACMAT), pp 31–40 CrossRefGoogle Scholar
  11. Crampton J, Khambhammettu H (2008b) Delegation in role-based access control. International Journal of Information Security 7(2):123–136 CrossRefGoogle Scholar
  12. Crampton J, Khambhammettu H (2008c) On delegation and workflow execution models. In: Proceedings of the 2008 ACM symposium on applied computing (SAC) Google Scholar
  13. Dumas M, Rosa ML, Mendling J, Maesaku R, Hajo AR, Semenenko N (2012) Understanding business process models: the costs and benefits of structuredness. In: Proceedings of the 24th International conference on advanced information systems engineering (CAiSE) Google Scholar
  14. Ferraiolo D, Barkley J, Kuhn D (1999) A role-based access control model and reference implementation within a corporate intranet. ACM Transactions on Information and System Security (TISSEC) 2(1) Google Scholar
  15. Ferraiolo DF, Kuhn DR, Chandramouli R (2007) Role-based access control, 2nd edn. Artech House, Norwood Google Scholar
  16. Gaaloul K, Charoy F (2009) Task delegation based access control models for workflow systems. In: Proceedings of the 9th IFIP conference on e-business, e-services, and e-society (I3E) Google Scholar
  17. Gaaloul K, Zahoor E, Charoy F, Godart C (2010) Dynamic authorisation policies for event-based task delegation. In: Proceedings of the 22nd International conference on advanced information systems engineering (CAiSE) Google Scholar
  18. Gaaloul K, Proper E, Charoy F (2011) An extended RBAC model for task delegation in workflow systems. In: Proceedings of the workshops on business informatics research Google Scholar
  19. Georgiadis CK, Mavridis I, Pangalos G, Thomas RK (2001) Flexible team-based access control using contexts. In: Proceedings of the 6th ACM symposium on access control models and technologies (SACMAT), pp 21–27 Google Scholar
  20. Ghorbel-Talbi MB, Cuppens F, Cuppens-Boulahia N (2010) Negotiating and delegating obligations. In: Proceedings of the International conference on management of emergent digital ecosystems (MEDES) Google Scholar
  21. Ghorbel-Talbi MB, Cuppens F, Cuppens-Boulahia N, Metayer DL, Piolle G (2011) Delegation of obligations and responsibility. In: Proceedings of the International information security and privacy conference (SEC) Google Scholar
  22. Hasebe K, Mabuchi M, Matsushita A (2010) Capability-based delegation model in RBAC. In: Proceedings of the 15th ACM symposium on access control models and technologies (SACMAT), pp 109–118 CrossRefGoogle Scholar
  23. Hoisl B, Sobernig S, Strembeck M (2014) Modeling and enforcing secure object flows in process-driven SOAs: an integrated model-driven approach. Software and Systems Modeling 2:513–548 CrossRefGoogle Scholar
  24. Hove SE, Anda B (2005) Experiences from conducting semi-structured interviews in empirical software engineering research. In: Proceedings of the 11th IEEE International software metrics symposium (METRICS) Google Scholar
  25. Joshi JBD, Bertino E (2006) Fine-grained role-based delegation in presence of the hybrid role hierarchy. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 81–90 Google Scholar
  26. Jürjens J (2005) Sound methods and effective tools for model-based security engineering with UML. In: Proceedings of the 27th International conference on software engineering (ICSE) Google Scholar
  27. Mouratidis H, Jürjens J (2010) From goal-driven security requirements engineering to secure design. International Journal of Intelligent Systems 25(8):813–840 CrossRefGoogle Scholar
  28. Neumann G, Sobernig S (2009) XOTcl 2.0 – a ten-year retrospective and outlook. In: Proceedings of the sixteenth annual Tcl/Tk conference Google Scholar
  29. Neumann G, Sobernig S (2011) An overview of the next scripting toolkit. In: Proceedings of the 18th annual Tcl/Tk conference Google Scholar
  30. Neumann G, Zdun U (2000) XOTcl, an object-oriented scripting language. In: Proceedings of Tcl2k: the 7th USENIX Tcl/Tk conference Google Scholar
  31. Neumann G, Zdun U (2012) XOTcl homepage. http://www.xotcl.org/. Accessed 2012-09-10
  32. Oh S, Park S (2003) Task-role-based access control model. Information Systems 28(6):533–562 CrossRefGoogle Scholar
  33. OMG (2011a) Meta object facility (MOF) core specification. Version 2.4.1, formal/2011-08-07. The Object Management Group. http://www.omg.org/spec/MOF. Accessed 2012-02-27
  34. OMG (2011b) Unified modeling language (OMG UML): superstructure. Version 2.4.1, formal/2011-08-06. The Object Management Group. http://www.omg.org/spec/UML
  35. OMG (2014) Object constraint language specification. Version 2.4, formal/2014-02-03. The Object Management Group. http://www.omg.org/spec/OCL. Accessed 2014-04-25
  36. Ousterhout J (1990) Tcl: an embeddable command language. In: Proceedings of the winter USENIX conference Google Scholar
  37. Ravichandran A, Yoon J (2006) Trust management with delegation in grouped peer-to-peer communities. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 71–80 Google Scholar
  38. Recker J, Indulska M, Rosemann M, Green P (2006) How good is BPMN really? Insights from theory and practice. In: 14th European conference on information systems Google Scholar
  39. Rodriguez A, de Guzman IGR (2007) Obtaining use case and security use cases from secure business process through the MDA approach. In: Proceedings of the international workshop on security in information systems (WOSIS) Google Scholar
  40. Rodriguez A, Fernandez-Medina E, Piattini M (2006) Towards a UML 2.0 extension for the modeling of security requirements in business processes. In: Proceedings of the international conference on trust and privacy in digital business (TrustBus) Google Scholar
  41. Runeson P, Höst M (2009) Guidelines for conducting and reporting case study research in software engineering. Empirical Software Engineering 14(2):131–164 CrossRefGoogle Scholar
  42. Russell N, Hofstede AHMT, Edmond D (2005) Workflow resource patterns: identification, representation and tool support. In: Proceedings of the 17th conference on advanced information systems engineering (CAiSE’05). Lecture notes in computer science, vol 3520. Springer, Heidelberg, pp 216–232 CrossRefGoogle Scholar
  43. Sandhu R, Coyne E, Feinstein H, Youman C (1996) Role-based access control models. IEEE Computer 29(2):38–47 CrossRefGoogle Scholar
  44. Schaad A (2001) Detecting conflicts in a role-based delegation model. In: Proceedings of the 17th annual computer security applications conference (ACSAC), pp 117–126 Google Scholar
  45. Schaad A, Moffett JD (2002) Delegation of obligations. In: Proceedings of the 3rd International workshop on policies for distributed systems and networks (POLICY) Google Scholar
  46. Schefer S, Strembeck M (2011a) Modeling process-related duties with extended UML activity and interaction diagrams. Electronic Communications of the EASST, 37 Google Scholar
  47. Schefer S, Strembeck M (2011b) Modeling support for delegating roles, tasks, and duties in a process-related RBAC context. In: International workshop on information systems security engineering (WISSE). Lecture notes in business information processing. Springer, Heidelberg Google Scholar
  48. Schefer S, Strembeck M, Mendling J, Baumgrass A (2011) Detecting and resolving conflicts of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 19th International conference on cooperative information systems (CoopIS). Lecture notes in computer science, vol 7044. Springer, Heidelberg Google Scholar
  49. Schefer-Wenzl S, Strembeck M, Baumgrass A (2012) An approach for consistent delegation in process-aware information systems. In: Proceedings of the 15th International conference on business information systems (BIS). Lecture notes in business information processing, vol 117. Springer, Heidelberg Google Scholar
  50. Schefer-Wenzl S, Sobernig S, Strembeck M (2013) Evaluating a UML-based modeling framework for process-related security properties: a qualitative multi-method study. In: Proceedings of the 21st European conference on information systems (ECIS), Utrecht Google Scholar
  51. Schmidt DC (2006) Model-driven engineering – guest editor’s introduction. IEEE Computer 39(2):25–31 CrossRefGoogle Scholar
  52. Selic B (2003) The pragmatics of model-driven development. IEEE Software 20(5):19–25 CrossRefGoogle Scholar
  53. Shang Q, Wang X (2008) Constraints for permission-based delegations. In: Proceedings of the 8th IEEE International conference on computer and information technology workshops (CITWORKSHOPS), pp 216–223 Google Scholar
  54. Sloman MS (1994) Policy driven management for distributed systems. Journal of Network and Systems Management 2(4):333–360 CrossRefGoogle Scholar
  55. Sohr K, Kuhlmann M, Gogolla M, Hu H, Ahn GJ (2012) Comprehensive two-level analysis of role-based delegation and revocation policies with UML and OCL. Information and Software Technology 54(12):1396–1417 CrossRefGoogle Scholar
  56. Stahl T, Völter M (2006) Model-driven software development. Wiley, New York Google Scholar
  57. Strembeck M (2005) Embedding policy rules for software-based systems in a requirements context. In: Proceedings of the 6th IEEE International workshop on policies for distributed systems and networks (POLICY) Google Scholar
  58. Strembeck M (2010) Scenario-driven role engineering. IEEE Security & Privacy 8(1):28–35 CrossRefGoogle Scholar
  59. Strembeck M, Mendling J (2010) Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 18th International conference on cooperative information systems (CoopIS). Lecture notes in computer science, vol 6426. Springer, Heidelberg Google Scholar
  60. Strembeck M, Mendling J (2011) Modeling process-related RBAC models with extended UML activity models. Information and Software Technology 53(5):456–483 CrossRefGoogle Scholar
  61. Tan K, Crampton J, Gunter CA (2004) The consistency of task-based authorization constraints in workflow systems. In: Proceedings of the 17th IEEE workshop on computer security foundations Google Scholar
  62. Thomas RK, Sandhu RS (1997) Task-based authorization controls (TBAC): a family of models for active and enterprise-oriented authorization management. In: Proceedings of the IFIP TC11 WG11.3 11th International conference on database security XI: status and prospects, pp 166–181 Google Scholar
  63. Vondal F (2012) Modellierung von Delegation in prozessbezogenen RBAC-Modellen – Eine Fallstudie. Bachelor thesis, WU Vienna Google Scholar
  64. Wainer J, Barthelmess P, Kumar A (2003) W-RBAC – a workflow security model incorporating controlled overriding of constraints. International Journal of Cooperative Information Systems 12(4):455 CrossRefGoogle Scholar
  65. Wainer J, Kumar A, Barthelmess P (2007) DW-RBAC: a formal security model of delegation and revocation in workflow systems. Information Systems 32(3):365–384 CrossRefGoogle Scholar
  66. Warner J, Atluri V (2006) Inter-instance authorization constraints for secure workflow management. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 190–199 Google Scholar
  67. Weske M (2012) Business process management: concepts, languages, architectures, 2nd edn. Springer, Heidelberg CrossRefGoogle Scholar
  68. Wolter C, Schaad A, Meinel C (2008) A transformation approach for security enhanced business processes. In: Proceedings of the IASTED International conference on software engineering Google Scholar
  69. Wolter C, Menzel M, Schaad A, Miseldine P, Meinel C (2009) Model-driven business process security requirement specification. Journal of Systems Architecture 55(4):211–223 CrossRefGoogle Scholar
  70. Zdun U, Strembeck M, Neumann G (2007) Object-based and class-based composition of transitive mixins. Information and Software Technology 49(8):871–891 CrossRefGoogle Scholar
  71. Zhang L, Ahn GJ, Chu BT (2003a) A rule-based framework for role-based delegation and revocation. ACM Transations on Information System Security 6(3):404–441 CrossRefGoogle Scholar
  72. Zhang X, Oh S, Sandhu R (2003b) PBDM: a flexible delegation model in RBAC. In: Proceedings of the 8th ACM symposium on access control models and technologies (SACMAT), pp 149–157 Google Scholar
  73. Zhao G, Chadwick D, Otenko S (2007) Obligations for role based access control. In: Proceedings of the 21st International conference on advanced information networking and applications workshops (AINAW), pp 424–431 CrossRefGoogle Scholar
  74. zur Muehlen M, Indulska M (2010) Modeling languages for business processes and business rules: a representational analysis. Information Systems 35(4):379–390 CrossRefGoogle Scholar

Copyright information

© Springer Fachmedien Wiesbaden 2014

Authors and Affiliations

  1. 1.Institute for Information Systems and New MediaWU ViennaViennaAustria
  2. 2.Competence Center for IT-SecurityUniversity of Applied Sciences Campus ViennaViennaAustria

Personalised recommendations