The specification and enforcement of authorization constraints in workflow management systems

TLDR

Workflow management systems are widely used to coordinate business processes, often at large scale, and typically employ role‑based security where roles are assigned to activities and constraints such as separation of duties are expressed as rules, but existing role‑based access control models are inadequate for modeling these constraints. This study introduces a logic‑programming language for expressing static and dynamic authorization constraints, defines formal consistency notions, and proposes algorithms to verify consistency and assign users and roles to workflow tasks without violating constraints. The authors develop a logic‑programming framework that encodes constraints as clauses, formalizes consistency checks, and implements algorithms that evaluate constraint consistency and compute user‑role assignments for workflow tasks.

Abstract

In recent years, workflow management systems (WFMSs) have gained popularity in both research and commercial sectors. WFMSs are used to coordinate and streamline business processes. Very large WFMSs are often used in organizations with users in the range of several thousands and process instances in the range of tens and thousands. To simplify the complexity of security administration, it is common practice in many businesses to allocate a role for each activity in the process and then assign one or more users to each role—granting an authorization to roles rather than to users. Typically, security policies are expressed as constraints (or rules) on users and roles; separation of duties is a well-known constraint. Unfortunately, current role-based access control models are not adequate to model such constraints. To address this issue we (1) present a language to express both static and dynamic authorization constraints as clauses in a logic program; (2) provide formal notions of constraint consistency; and (3) propose algorithms to check the consistency of constraints and assign users and roles to tasks that constitute the workflow in such a way that no constraints are violated.