Model checking authorization requirements in business processes

doi:10.1016/j.cose.2013.10.002

2014-02-01

PRE

Alessandro Armando *

Serena Elisa Ponta

DOI：10.1016/j.cose.2013.10.002

原文链接

原文求助

摘要

En 中文

Business processes are usually expected to meet high level authorization requirements (e.g., Separation of Duty). Since violation of authorization requirements may lead to economic losses and/or legal implications, ensuring that a business process meets them is of paramount importance. Previous work showed that model checking can be profitably used to check authorization requirements in business processes. However, building formal models that simultaneously account for both the workflow and the access control policy is a time consuming and error-prone activity. In this paper we present a new approach to model checking authorization requirements in business processes that allows for the separate specification of the workflow and of the associated access control policy while retaining the ability to carry out a fully automatic analysis of the business process. To illustrate the effectiveness of the approach we describe its application to a Loan Origination Process subject to an RBAC access control policy featuring conditional permission assignments and delegation. (C) 2013 Elsevier Ltd. All rights reserved.

Keyword:

Model checking

Security-sensitive business process

Authorization requirements

Access control

Organizational control

Automatic security analysis