DW-RBAC: A formal security model of delegation and revocation in workflow systems

One reason workflow systems have been criticized as being inflexible is that they lack support for delegation. This paper shows how delegation can be introduced in a workflow system by extending the role-based access control (RBAC) model. The current RBAC model is a security mechanism to implement access control in organizations by allowing users to be assigned to roles and privileges to be associated with the roles. Thus, users can perform tasks based on the privileges possessed by their own role or roles they inherit by virtue of their organizational position. However, there is no easy way to handle delegations within this model. This paper tries to treat the issues surrounding delegation in workflow systems in a comprehensive way. We show how delegations can be incorporated into the RBAC model in a simple and straightforward manner. The new extended model is called RBAC with delegation in a workflow context (DW-RBAC). It allows for delegations to be specified from a user to another user, and later revoked when the delegation is no longer required. The implications of such specifications and their subsequent revocations are examined. Several formal definitions for assertion, acceptance, execution and revocation are provided, and proofs are given for the important properties of our delegation framework.

[1]  Vijayalakshmi Atluri,et al.  Supporting conditional delegation in secure workflow management systems , 2005, SACMAT '05.

[2]  Vijayalakshmi Atluri,et al.  An authorization model for temporal and derived data: securing information portals , 2002, TSEC.

[3]  Silvana Castano,et al.  Managing Workflow Authorization Constraints through Active Database Technology , 2001, Inf. Syst. Frontiers.

[4]  Ravi S. Sandhu,et al.  PBDM: a flexible delegation model in RBAC , 2003, SACMAT '03.

[5]  Trent Jaeger,et al.  Proceedings of the Fourth ACM Workshop on Role-Based Access Control, RBAC 1999, Fairfax, VA, USA, October 28-29, 1999 , 1997, RBAC.

[6]  Ramaswamy Chandramouli,et al.  Role-Based Access Control Features in Commercial Database Management Systems , 1998 .

[7]  Vijayalakshmi Atluri,et al.  SecureFlow: a secure Web-enabled workflow management system , 1999, RBAC '99.

[8]  Elisa Bertino,et al.  A flexible model supporting the specification and enforcement of role-based authorization in workflow management systems , 1997, RBAC '97.

[9]  E Flahavin,et al.  19th National Information Systems Security Conference , 1997 .

[10]  Mads Dam,et al.  Constrained delegation , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.

[11]  Ravi S. Sandhu,et al.  Framework for role-based delegation models , 2000, Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00).

[12]  Walt Yao,et al.  Fidelis: A Policy-Driven Trust Management Framework , 2003, iTrust.

[13]  BongNam Noh,et al.  A Role-Based Delegation Model Using Role Hierarchy Supporting Restricted Permission Inheritance , 2003, Security and Management.

[14]  Patrick C. K. Hung,et al.  A study of least privilege in CapBasED-AMS , 1998, Proceedings. 3rd IFCIS International Conference on Cooperative Information Systems (Cat. No.98EX122).

[15]  Günther Pernul,et al.  Viewing Business-Process Security from Different Perspectives , 1999, Int. J. Electron. Commer..

[16]  Hagit Borer.  How Fine-Grained? , 2005 .

[17]  Elisa Bertino,et al.  Supporting Delegation in Secure Workflow Management Systems , 2003, DBSec.

[18]  Elisa Bertino,et al.  The specification and enforcement of authorization constraints in workflow management systems , 1999, TSEC.

[19]  Gail-Joon Ahn,et al.  Injecting RBAC to secure a Web-based workflow system , 2000, RBAC '00.

[20]  Roberto Tamassia,et al.  Role-based cascaded delegation , 2004, SACMAT '04.

[21]  Jean Bacon,et al.  A model of OASIS role-based access control and its support for active security , 2002, ACM Trans. Inf. Syst. Secur..

[22]  Jacques Wainer,et al.  Applying scheduling techniques to minimize the number of late jobs in workflow systems , 2004, SAC '04.

[23]  Patrick C. K. Hung,et al.  Security Enforcement in Activity Management Systems , 1998 .

[24]  Akhil Kumar,et al.  Dynamic Work Distribution in Workflow Management Systems: How to Balance Quality and Performance , 2002, J. Manag. Inf. Syst..

[25]  Akhil Kumar,et al.  A fine-grained, controllable, user-to-user delegation method in RBAC , 2005, SACMAT '05.

[26]  Vijayalakshmi Atluri,et al.  A Petri Net Based Safety Analysis of Workflow Authorization Models , 2000, J. Comput. Secur..

[27]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[28]  Vijayalakshmi Atluri,et al.  An Authorization Model for Workflows , 1996, ESORICS.

[29]  Ravi Sandhu,et al.  A Role-Based Delegation Model and Some Extensions , 2000 .

[30]  Vijayalakshmi Atluri,et al.  A Petri net based safety analysis of workflow authorization models^1 , 2000 .

[31]  Akhil Kumar,et al.  W-RBAC - A Workflow Security Model Incorporating Controlled Overriding of Constraints , 2003, Int. J. Cooperative Inf. Syst..

[32]  Vijay Varadharajan,et al.  Resolving Conflicts in Authorization Delegations , 2002, ACISP.