Supporting delegation in secure workflow management systems

Abstract

Workflow systems are today used in numerous business application domains including office automation, finance and banking, as well as in scientific application domains, for automating their day-to-day applications, Often, organizations establish a set of security policies that regulate how the business process and resources should be managed. For reasons of ease in management, these security policies are expressed in terms of roles. In addition to simple authorization rules specifying which subject/role can execute a task in a workflow, many business processes require support for more complex authorization constraints, such as separation of duties. In this paper, we present an approach that supports delegation and assign users to roles in such a way that no constraints are violated. In particular, we introduce the notion of delegation consistency and propose algorithms to assign tasks to users such that they guarantee delegation consistency. © 2004 by International Federation for Information Processing.