Verifying Workflow Processes against Organization Security Policies
نویسندگان
چکیده
Workflow applications for large complex organizations often need to cross several security domains, each with different management and specific security requirements. The resultant cross-dependency between the workflow specification and the security policy of each domain can be hard to manage without specific tools. This work presents a static analyzer that automatically verifies the consistency between workflow specifications written in WPDL (Workflow Process Definition Language) and organization security policies, written in a security language specially designed to express simultaneously several security policies.
منابع مشابه
Modeling and Verifying Security Policies in Business Processes
Modern information systems are large-sized and comprise multiple heterogeneous and autonomous components. Autonomy enables decentralization, but it also implies that components providers are free to change, retire, or introduce new components. This is a threat to security, and calls for a continuous verification process to ensure compliance with security policies. Existing verification framewor...
متن کاملSpecification and Verification of Secure Business Transaction Systems
Every organization has policies, defined either implicitly or explicitly, that are intended to influence the behavior of subjects and objects associated with the organization. A policy is a rule or a set of constraints that applies to some scenario in the daily lifecycle of the organization’s activity. Business rules describe terms and conditions, service provisions, contracts and their executi...
متن کاملSynthesizing and Verifying Plans for Constrained Workflows: Transferring Tools from Formal Methods
Many business processes are modeled as workflows and workflow management systems are used to specify and coordinate the execution of those business processes. The execution of workflows is often constrained, e.g. by business rules, legal requirements or access control. It is therefore important to know whether a workflow specification is consistent and so implementable. This question of workflo...
متن کاملA Process Model for Workflow Mining
Numerous type of information systems record event data about executed tasks. Workflow mining is concerned with the origin of a graphical workflow model out of this data. Workflow mining is a highly interactive process. The mining expert repeatedly approaches the result by changing the parameter of the mining tool and verifying the mined models. The modeling of business process in a computerized...
متن کاملSPL: An access control language for security policies with complex constraints
Most organizations use several security policies to control different systems and data, comprising in this way a global complex policy. These security policies are often scattered over different environments, each one with its own security model and domain of administration, making them difficult to administer and understand. Moreover, some applications (e.g. workflow), often need to cross seve...
متن کامل