An Event-Based, Role-Based Authorization Model for Healthcare Workflow Systems

  • Vassiliki Koufi
  • Flora Malamateniou
  • Eleni Mytilinaiou
  • George Vassilacopoulos
Part of the Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering book series (LNICST, volume 69)


Authorization and access control is of primary importance to workflow healthcare environments. Although task dependencies in the workflow give rise to the need for a specific ordering of task executions, it is authorization that determines who can execute the various tasks that comprise the workflow and what information can be accessed during task executions. Furthermore, a challenge of workflow security is to enforce the least privilege principle (i.e. users must be allowed to receive the least possible permissions required to perform a task) throughout workflow execution in order to reduce the risk of compromising information integrity during task executions. However, adherence to the least privilege principle often requires the enforcement of dynamic, contextual constraints so that authorizations for access to data during task executions are granted to and revoked from users dynamically. This paper discusses an event-based, role-based workflow authorization model and mechanism that addresses this issue. In particular, the model augments the capabilities of traditional role-based access control (RBAC) models by allowing user roles to change dynamically during workflow execution based on the occurrence of specific events, in order to prevent users from acquiring unnecessary privileges during workflow task executions and, hence, synchronizing authorization flow with the progression of the workflow.


healthcare workflow systems role-based authorization least privilege principle ECA rules 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Abrahams, A.S., Eyers, D.M., Bacon, J.M.: An Event-Based Paradigm for E-Commerce Application Specification and Execution. LNCS Information Security, Technical Report 6(2), 59–68 (2001)Google Scholar
  2. 2.
    Atluri, V.: Security for Workflow Systems. LNCS Information Security, Technical Report 6(2), 59–68 (2001) Google Scholar
  3. 3.
    Botha, A.R., Eloff, H.P.: A Framework for Access Control in Workflow Systems. Inform. Manage. Comput. Se. 9(3), 126–133 (2001)Google Scholar
  4. 4.
    Casati, F., Castano, S., Fugini, M.: Managing Workflow Authorization Constraints through Active Database Technology. Inf. Syst. Front. 3(3), 319–338 (2001)CrossRefGoogle Scholar
  5. 5.
    Dey, A.K., Abowed, G.D.: The Context Toolkit: Aiding the Development of Context-Aware Applications. In: Human Factors in Computing Systems (CHI 1999), Pittsburgh, PA, May 15-20, pp. 434–441 (1999)Google Scholar
  6. 6.
    Goh, A., Koh, Y.K., Domazet, D.S.: ECA Rule-based Support for Workflows. Artif. Intell Eng. 15, 37–46 (2001)CrossRefGoogle Scholar
  7. 7.
    Lenz, R., Reichert, M.: IT Support for Business processes. In: van der Aalst, W.M.P., Benatallah, B., Casati, F., Curbera, F. (eds.) BPM 2005. LNCS, vol. 3649, pp. 354–363. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  8. 8.
    Malamateniou, F., Vassilacopoulos, G., Tsanakas, P.: A Workflow Based Approach to Virtual Patient Record Security. IEEE T. Inf. Technol. B. 2(3), 139–145 (1998)CrossRefGoogle Scholar
  9. 9.
    Zhou, X., Wang, Z.: An Access Control Model of Workflow System Integrating RBAC and TBAC. Integration and Innovation Orient to E-Society 2, 246–251 (2008)CrossRefGoogle Scholar
  10. 10.
    Xing, G., Xue, S., Liu, F.: Design of Role-Based Security Access Control Model in the Workflow. In: 1st IEEE International Conference on Information Science and Engineering (ICISE 2009), Nanjing, Jiangsu China, December 26-28, pp. 1711–1715 (2009)Google Scholar
  11. 11.
    Zhao, H., Fang, Z., Xu, P., Zhao, L., Liu, J., Wang, T.: An Improved Role-Based Workflow Access Control Model. In: 5th International Conference on Information Technology: New Generations (ITNG 2008), Las Vegas, Nevada, USA, April 7-8 (2008)Google Scholar
  12. 12.
    DeCarlo, A.L.: Dynamic Business Process Management (BPM): Applying a Role-Based Approach to Business Process Management, InformationWeek, Business Technology Network (2009),
  13. 13.
    Byron, D.: Role-based Business Process Management: A Good Way to Think of BPM, IT Business Edge (2009),

Copyright information

© ICST Institute for Computer Science, Social Informatics and Telecommunications Engineering 2011

Authors and Affiliations

  • Vassiliki Koufi
    • 1
  • Flora Malamateniou
    • 1
  • Eleni Mytilinaiou
    • 1
  • George Vassilacopoulos
    • 1
  1. 1.Department of Digital SystemsUniversity of PiraeusPiraeusGreece

Personalised recommendations