Skip to main content
SpringerLink
Log in

Modeling Support for Role-Based Delegation in Process-Aware Information Systems

  • Research Paper
  • Published:
Business & Information Systems Engineering Aims and scope Submit manuscript

Abstract

In the paper, an integrated approach for the modeling and enforcement of delegation policies in process-aware information systems is presented. In particular, a delegation extension for process-related role-based access control (RBAC) models is specified. The extension is generic in the sense that it can be used to extend process-aware information systems or process modeling languages with support for process-related RBAC delegation models. Moreover, the detection of delegation-related conflicts is discussed and a set of pre-defined resolution strategies for each potential conflict is provided. Thereby, the design-time and runtime consistency of corresponding RBAC delegation models can be ensured. Based on a formal metamodel, UML2 modeling support for the delegation of roles, tasks, and duties is provided. A corresponding case study evaluates the practical applicability of the approach with real-world business processes. Moreover, the approach is implemented as an extension to the BusinessActivity library and runtime engine.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Algorithm 1
Algorithm 2
Algorithm 3
Algorithm 4
Fig. 10
Fig. 11
OCL Constraint 1
OCL Constraint 6
OCL Constraint 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16

Similar content being viewed by others

Notes

  1. We assume that each subject can (at the subject’s discretion) activate the roles that are directly assigned to this subject as well as the junior-roles of its directly assigned roles (see, e.g., Ferraiolo et al. 1999; Sandhu et al. 1996)

References

  • Atluri V, Warner J (2005) Supporting conditional delegation in secure workflow management systems. In: Proceedings of the 10th ACM symposium on access control models and technologies (SACMAT), pp 49–58

    Google Scholar 

  • BAL (2012) Business activity library and runtime engine. http://wi.wu.ac.at/home/mark/BusinessActivities/library.html. Accessed 2012-09-24

  • Barka E, Sandhu R (2000a) A role-based delegation model and some extensions. In: Proceedings of the 23rd national information systems security conference (NISSEC)

    Google Scholar 

  • Barka E, Sandhu R (2000b) Framework for role-based delegation models. In: Proceedings of the 16th annual computer security applications conference (ACSAC)

    Google Scholar 

  • Basin D, Doser J, Lodderstedt T (2006) Model driven security: from UML models to access control Infrastructure. ACM Transactions on Software Engineering and Methodolocy 15(1):39–91

    Article  Google Scholar 

  • Botha RA, Eloff JH (2001) Separation of duties for access control enforcement in workflow environments. IBM Systems Journal 40(3):666–682

    Article  Google Scholar 

  • Casati F, Castano S, Fugini M (2001) Managing workflow authorization constraints through active database technology. Information Systems Frontiers 3(3):319–338

    Article  Google Scholar 

  • Cole J, Derrick J, Milosevic Z, Raymond K (2001) Author obliged to submit paper before 4 July: policies in an enterprise specification. In: Proceedings of the International workshop on policies for distributed systems and networks (POLICY), pp 1–17

    Chapter  Google Scholar 

  • Corbin J, Strauss A (2008) Basics of qualitative research: techniques and procedures for developing grounded theory. Sage, Thousand Oaks

    Google Scholar 

  • Crampton J, Khambhammettu H (2008a) Delegation and satisfiability in workflow systems. In: Proceedings of the 13th ACM symposium on access control models and technologies (SACMAT), pp 31–40

    Chapter  Google Scholar 

  • Crampton J, Khambhammettu H (2008b) Delegation in role-based access control. International Journal of Information Security 7(2):123–136

    Article  Google Scholar 

  • Crampton J, Khambhammettu H (2008c) On delegation and workflow execution models. In: Proceedings of the 2008 ACM symposium on applied computing (SAC)

    Google Scholar 

  • Dumas M, Rosa ML, Mendling J, Maesaku R, Hajo AR, Semenenko N (2012) Understanding business process models: the costs and benefits of structuredness. In: Proceedings of the 24th International conference on advanced information systems engineering (CAiSE)

    Google Scholar 

  • Ferraiolo D, Barkley J, Kuhn D (1999) A role-based access control model and reference implementation within a corporate intranet. ACM Transactions on Information and System Security (TISSEC) 2(1)

  • Ferraiolo DF, Kuhn DR, Chandramouli R (2007) Role-based access control, 2nd edn. Artech House, Norwood

    Google Scholar 

  • Gaaloul K, Charoy F (2009) Task delegation based access control models for workflow systems. In: Proceedings of the 9th IFIP conference on e-business, e-services, and e-society (I3E)

    Google Scholar 

  • Gaaloul K, Zahoor E, Charoy F, Godart C (2010) Dynamic authorisation policies for event-based task delegation. In: Proceedings of the 22nd International conference on advanced information systems engineering (CAiSE)

    Google Scholar 

  • Gaaloul K, Proper E, Charoy F (2011) An extended RBAC model for task delegation in workflow systems. In: Proceedings of the workshops on business informatics research

    Google Scholar 

  • Georgiadis CK, Mavridis I, Pangalos G, Thomas RK (2001) Flexible team-based access control using contexts. In: Proceedings of the 6th ACM symposium on access control models and technologies (SACMAT), pp 21–27

    Google Scholar 

  • Ghorbel-Talbi MB, Cuppens F, Cuppens-Boulahia N (2010) Negotiating and delegating obligations. In: Proceedings of the International conference on management of emergent digital ecosystems (MEDES)

    Google Scholar 

  • Ghorbel-Talbi MB, Cuppens F, Cuppens-Boulahia N, Metayer DL, Piolle G (2011) Delegation of obligations and responsibility. In: Proceedings of the International information security and privacy conference (SEC)

    Google Scholar 

  • Hasebe K, Mabuchi M, Matsushita A (2010) Capability-based delegation model in RBAC. In: Proceedings of the 15th ACM symposium on access control models and technologies (SACMAT), pp 109–118

    Chapter  Google Scholar 

  • Hoisl B, Sobernig S, Strembeck M (2014) Modeling and enforcing secure object flows in process-driven SOAs: an integrated model-driven approach. Software and Systems Modeling 2:513–548

    Article  Google Scholar 

  • Hove SE, Anda B (2005) Experiences from conducting semi-structured interviews in empirical software engineering research. In: Proceedings of the 11th IEEE International software metrics symposium (METRICS)

    Google Scholar 

  • Joshi JBD, Bertino E (2006) Fine-grained role-based delegation in presence of the hybrid role hierarchy. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 81–90

    Google Scholar 

  • Jürjens J (2005) Sound methods and effective tools for model-based security engineering with UML. In: Proceedings of the 27th International conference on software engineering (ICSE)

    Google Scholar 

  • Mouratidis H, Jürjens J (2010) From goal-driven security requirements engineering to secure design. International Journal of Intelligent Systems 25(8):813–840

    Article  Google Scholar 

  • Neumann G, Sobernig S (2009) XOTcl 2.0 – a ten-year retrospective and outlook. In: Proceedings of the sixteenth annual Tcl/Tk conference

    Google Scholar 

  • Neumann G, Sobernig S (2011) An overview of the next scripting toolkit. In: Proceedings of the 18th annual Tcl/Tk conference

    Google Scholar 

  • Neumann G, Zdun U (2000) XOTcl, an object-oriented scripting language. In: Proceedings of Tcl2k: the 7th USENIX Tcl/Tk conference

    Google Scholar 

  • Neumann G, Zdun U (2012) XOTcl homepage. http://www.xotcl.org/. Accessed 2012-09-10

  • Oh S, Park S (2003) Task-role-based access control model. Information Systems 28(6):533–562

    Article  Google Scholar 

  • OMG (2011a) Meta object facility (MOF) core specification. Version 2.4.1, formal/2011-08-07. The Object Management Group. http://www.omg.org/spec/MOF. Accessed 2012-02-27

  • OMG (2011b) Unified modeling language (OMG UML): superstructure. Version 2.4.1, formal/2011-08-06. The Object Management Group. http://www.omg.org/spec/UML

  • OMG (2014) Object constraint language specification. Version 2.4, formal/2014-02-03. The Object Management Group. http://www.omg.org/spec/OCL. Accessed 2014-04-25

  • Ousterhout J (1990) Tcl: an embeddable command language. In: Proceedings of the winter USENIX conference

    Google Scholar 

  • Ravichandran A, Yoon J (2006) Trust management with delegation in grouped peer-to-peer communities. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 71–80

    Google Scholar 

  • Recker J, Indulska M, Rosemann M, Green P (2006) How good is BPMN really? Insights from theory and practice. In: 14th European conference on information systems

    Google Scholar 

  • Rodriguez A, de Guzman IGR (2007) Obtaining use case and security use cases from secure business process through the MDA approach. In: Proceedings of the international workshop on security in information systems (WOSIS)

    Google Scholar 

  • Rodriguez A, Fernandez-Medina E, Piattini M (2006) Towards a UML 2.0 extension for the modeling of security requirements in business processes. In: Proceedings of the international conference on trust and privacy in digital business (TrustBus)

    Google Scholar 

  • Runeson P, Höst M (2009) Guidelines for conducting and reporting case study research in software engineering. Empirical Software Engineering 14(2):131–164

    Article  Google Scholar 

  • Russell N, Hofstede AHMT, Edmond D (2005) Workflow resource patterns: identification, representation and tool support. In: Proceedings of the 17th conference on advanced information systems engineering (CAiSE’05). Lecture notes in computer science, vol 3520. Springer, Heidelberg, pp 216–232

    Chapter  Google Scholar 

  • Sandhu R, Coyne E, Feinstein H, Youman C (1996) Role-based access control models. IEEE Computer 29(2):38–47

    Article  Google Scholar 

  • Schaad A (2001) Detecting conflicts in a role-based delegation model. In: Proceedings of the 17th annual computer security applications conference (ACSAC), pp 117–126

    Google Scholar 

  • Schaad A, Moffett JD (2002) Delegation of obligations. In: Proceedings of the 3rd International workshop on policies for distributed systems and networks (POLICY)

    Google Scholar 

  • Schefer S, Strembeck M (2011a) Modeling process-related duties with extended UML activity and interaction diagrams. Electronic Communications of the EASST, 37

  • Schefer S, Strembeck M (2011b) Modeling support for delegating roles, tasks, and duties in a process-related RBAC context. In: International workshop on information systems security engineering (WISSE). Lecture notes in business information processing. Springer, Heidelberg

    Google Scholar 

  • Schefer S, Strembeck M, Mendling J, Baumgrass A (2011) Detecting and resolving conflicts of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 19th International conference on cooperative information systems (CoopIS). Lecture notes in computer science, vol 7044. Springer, Heidelberg

    Google Scholar 

  • Schefer-Wenzl S, Strembeck M, Baumgrass A (2012) An approach for consistent delegation in process-aware information systems. In: Proceedings of the 15th International conference on business information systems (BIS). Lecture notes in business information processing, vol 117. Springer, Heidelberg

    Google Scholar 

  • Schefer-Wenzl S, Sobernig S, Strembeck M (2013) Evaluating a UML-based modeling framework for process-related security properties: a qualitative multi-method study. In: Proceedings of the 21st European conference on information systems (ECIS), Utrecht

    Google Scholar 

  • Schmidt DC (2006) Model-driven engineering – guest editor’s introduction. IEEE Computer 39(2):25–31

    Article  Google Scholar 

  • Selic B (2003) The pragmatics of model-driven development. IEEE Software 20(5):19–25

    Article  Google Scholar 

  • Shang Q, Wang X (2008) Constraints for permission-based delegations. In: Proceedings of the 8th IEEE International conference on computer and information technology workshops (CITWORKSHOPS), pp 216–223

    Google Scholar 

  • Sloman MS (1994) Policy driven management for distributed systems. Journal of Network and Systems Management 2(4):333–360

    Article  Google Scholar 

  • Sohr K, Kuhlmann M, Gogolla M, Hu H, Ahn GJ (2012) Comprehensive two-level analysis of role-based delegation and revocation policies with UML and OCL. Information and Software Technology 54(12):1396–1417

    Article  Google Scholar 

  • Stahl T, Völter M (2006) Model-driven software development. Wiley, New York

    Google Scholar 

  • Strembeck M (2005) Embedding policy rules for software-based systems in a requirements context. In: Proceedings of the 6th IEEE International workshop on policies for distributed systems and networks (POLICY)

    Google Scholar 

  • Strembeck M (2010) Scenario-driven role engineering. IEEE Security & Privacy 8(1):28–35

    Article  Google Scholar 

  • Strembeck M, Mendling J (2010) Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 18th International conference on cooperative information systems (CoopIS). Lecture notes in computer science, vol 6426. Springer, Heidelberg

    Google Scholar 

  • Strembeck M, Mendling J (2011) Modeling process-related RBAC models with extended UML activity models. Information and Software Technology 53(5):456–483

    Article  Google Scholar 

  • Tan K, Crampton J, Gunter CA (2004) The consistency of task-based authorization constraints in workflow systems. In: Proceedings of the 17th IEEE workshop on computer security foundations

    Google Scholar 

  • Thomas RK, Sandhu RS (1997) Task-based authorization controls (TBAC): a family of models for active and enterprise-oriented authorization management. In: Proceedings of the IFIP TC11 WG11.3 11th International conference on database security XI: status and prospects, pp 166–181

    Google Scholar 

  • Vondal F (2012) Modellierung von Delegation in prozessbezogenen RBAC-Modellen – Eine Fallstudie. Bachelor thesis, WU Vienna

  • Wainer J, Barthelmess P, Kumar A (2003) W-RBAC – a workflow security model incorporating controlled overriding of constraints. International Journal of Cooperative Information Systems 12(4):455

    Article  Google Scholar 

  • Wainer J, Kumar A, Barthelmess P (2007) DW-RBAC: a formal security model of delegation and revocation in workflow systems. Information Systems 32(3):365–384

    Article  Google Scholar 

  • Warner J, Atluri V (2006) Inter-instance authorization constraints for secure workflow management. In: Proceedings of the 11th ACM symposium on access control models and technologies (SACMAT), pp 190–199

    Google Scholar 

  • Weske M (2012) Business process management: concepts, languages, architectures, 2nd edn. Springer, Heidelberg

    Book  Google Scholar 

  • Wolter C, Schaad A, Meinel C (2008) A transformation approach for security enhanced business processes. In: Proceedings of the IASTED International conference on software engineering

    Google Scholar 

  • Wolter C, Menzel M, Schaad A, Miseldine P, Meinel C (2009) Model-driven business process security requirement specification. Journal of Systems Architecture 55(4):211–223

    Article  Google Scholar 

  • Zdun U, Strembeck M, Neumann G (2007) Object-based and class-based composition of transitive mixins. Information and Software Technology 49(8):871–891

    Article  Google Scholar 

  • Zhang L, Ahn GJ, Chu BT (2003a) A rule-based framework for role-based delegation and revocation. ACM Transations on Information System Security 6(3):404–441

    Article  Google Scholar 

  • Zhang X, Oh S, Sandhu R (2003b) PBDM: a flexible delegation model in RBAC. In: Proceedings of the 8th ACM symposium on access control models and technologies (SACMAT), pp 149–157

    Google Scholar 

  • Zhao G, Chadwick D, Otenko S (2007) Obligations for role based access control. In: Proceedings of the 21st International conference on advanced information networking and applications workshops (AINAW), pp 424–431

    Chapter  Google Scholar 

  • zur Muehlen M, Indulska M (2010) Modeling languages for business processes and business rules: a representational analysis. Information Systems 35(4):379–390

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Institute for Information Systems and New Media, WU Vienna, 1090, Vienna, Austria

    Sigrid Schefer-Wenzl &  Mark Strembeck

  2. Competence Center for IT-Security, University of Applied Sciences Campus Vienna, 1090, Vienna, Austria

    Sigrid Schefer-Wenzl

Authors
  1. Sigrid Schefer-Wenzl
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Mark Strembeck
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sigrid Schefer-Wenzl.

Additional information

Accepted after two revisions by Prof. Dr. Becker.

This article is also available in German in print and via http://www.wirtschaftsinformatik.de: Schefer-Wenzl S, Strembeck M (2014) Modellierungsunterstützung für die rollenbasierte Delegation in prozessgestützten Informationssystemen. WIRTSCHAFTSINFORMATIK. doi: 10.1007/s11576-014-0433-3.

Electronic Supplementary Material

Below is the link to the electronic supplementary material.

(PDF 408 kB)

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Schefer-Wenzl, S., Strembeck, M. Modeling Support for Role-Based Delegation in Process-Aware Information Systems. Bus Inf Syst Eng 6, 215–237 (2014). https://doi.org/10.1007/s12599-014-0343-3

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12599-014-0343-3

Keywords

Search

Navigation