An Event-Based, Role-Based Authorization Model for Healthcare Workflow Systems
Authorization and access control is of primary importance to workflow healthcare environments. Although task dependencies in the workflow give rise to the need for a specific ordering of task executions, it is authorization that determines who can execute the various tasks that comprise the workflow and what information can be accessed during task executions. Furthermore, a challenge of workflow security is to enforce the least privilege principle (i.e. users must be allowed to receive the least possible permissions required to perform a task) throughout workflow execution in order to reduce the risk of compromising information integrity during task executions. However, adherence to the least privilege principle often requires the enforcement of dynamic, contextual constraints so that authorizations for access to data during task executions are granted to and revoked from users dynamically. This paper discusses an event-based, role-based workflow authorization model and mechanism that addresses this issue. In particular, the model augments the capabilities of traditional role-based access control (RBAC) models by allowing user roles to change dynamically during workflow execution based on the occurrence of specific events, in order to prevent users from acquiring unnecessary privileges during workflow task executions and, hence, synchronizing authorization flow with the progression of the workflow.
Keywordshealthcare workflow systems role-based authorization least privilege principle ECA rules
Unable to display preview. Download preview PDF.
- 1.Abrahams, A.S., Eyers, D.M., Bacon, J.M.: An Event-Based Paradigm for E-Commerce Application Specification and Execution. LNCS Information Security, Technical Report 6(2), 59–68 (2001)Google Scholar
- 2.Atluri, V.: Security for Workflow Systems. LNCS Information Security, Technical Report 6(2), 59–68 (2001) Google Scholar
- 3.Botha, A.R., Eloff, H.P.: A Framework for Access Control in Workflow Systems. Inform. Manage. Comput. Se. 9(3), 126–133 (2001)Google Scholar
- 5.Dey, A.K., Abowed, G.D.: The Context Toolkit: Aiding the Development of Context-Aware Applications. In: Human Factors in Computing Systems (CHI 1999), Pittsburgh, PA, May 15-20, pp. 434–441 (1999)Google Scholar
- 10.Xing, G., Xue, S., Liu, F.: Design of Role-Based Security Access Control Model in the Workflow. In: 1st IEEE International Conference on Information Science and Engineering (ICISE 2009), Nanjing, Jiangsu China, December 26-28, pp. 1711–1715 (2009)Google Scholar
- 11.Zhao, H., Fang, Z., Xu, P., Zhao, L., Liu, J., Wang, T.: An Improved Role-Based Workflow Access Control Model. In: 5th International Conference on Information Technology: New Generations (ITNG 2008), Las Vegas, Nevada, USA, April 7-8 (2008)Google Scholar
- 12.DeCarlo, A.L.: Dynamic Business Process Management (BPM): Applying a Role-Based Approach to Business Process Management, InformationWeek, Business Technology Network (2009), http://business-agility.techweb.com/articles/02042009.jhtml
- 13.Byron, D.: Role-based Business Process Management: A Good Way to Think of BPM, IT Business Edge (2009), http://www.itbusinessedge.com/cm/blogs/byron/role-based-business-process-management-a-good-way-to-think-of-bpm/?cs=34553