An approach to capture authorisation requirements in business processes

Requirements Engineering

Volumn 15, Issue 4, 2010, Pages 359-373

  Wolter, Christian ^a   Meinel, Christoph ^b  

^a BOMBARDIER TRANSPORTATION   (Sweden)

^b UNIVERSITY OF POTSDAM   (Germany)

Author keywords

Access control; Authorisation requirement; Business process management; Process modelling; Verification

Indexed keywords

AUTHORISATION REQUIREMENT; BUSINESS ANALYSTS; BUSINESS PROCESS; BUSINESS PROCESS MANAGEMENT; BUSINESS PROCESS MODELLING; FORMAL SEMANTICS; MODEL-CHECKING TECHNIQUES; MULTI-LEVEL; NEW MODEL; NON-FUNCTIONAL; PROCESS MODEL; PROCESS MODELLING; PROTOTYPE IMPLEMENTATIONS; ROLE-BASED; SECURITY EXPERTS; SEPARATION OF DUTY;

ENTERPRISE RESOURCE MANAGEMENT; FORMAL METHODS; MODEL CHECKING; SECURITY SYSTEMS; SEMANTICS;

ACCESS CONTROL;

EID: 79451469078     PISSN: 09473602     EISSN: 1432010X     Source Type: Journal    
DOI: 10.1007/s00766-010-0103-y     Document Type: Article

References (43)

1. Pavlovski CJ, Zou J (2008) Non-functional requirements in business process modeling. In: APCCM. pp 103-112
2. Russell D, Gangemi GT Sr (1991) Computer security basics. O'Reilly & Associates, Inc., Sebastopol
3. Hu VC, Ferraiolo DF, Kuhn DR (2006) Assessment of access control systems
4. Schneider G, Winters JP (2001) Applying use cases (2nd ed): a practical guide. Addison-Wesley Longman Publishing Co., Inc., Boston
5. Jacobson I (1995) The use-case construct in object-oriented software engineering. pp 309-336
6. Anjard RP (1996) Process mapping: one of three, new, special quality tools for management, quality and all other professionals. Microelectron Reliab 36(2):223-225
7. Dumas M, Arthur HM (2001) Uml activity diagrams as a workflow specification language. Lect Notes Comput Sci 2185:76-90
8. Object Management Group (2006) Business process modeling notation specification. http://www.bpmn.org
9. Wolter C, Schaad A, Meinel C (2008) Task-based entailment constraints for basic workflow patterns. In: SACMAT '08: proceedings of the 13th ACM symposium on access control models and technologies. New York, ACM, pp 51-60
10. Yu ESK (1997) Towards modeling and reasoning support for early-phase requirements engineering. In: RE '97: proceedings of the 3rd IEEE international symposium on requirements engineering (RE'97). IEEE Computer Society, Washington, DC, p 226
11. Bell DE (2005) Looking back at the Bell-La Padula model. In: ACSAC '05: proceedings of the 21st annual computer security applications conference. IEEE Computer Society, Washington, DC, pp 337-351
12. Clark DD, Wilson DR (1987) A comparison of commercial and military computer security policies. Secur Priv 00:184
13. Ferraiolo DF, Sandhu R, Gavrila S, Kuhn DR, Chandramouli R (2001) Proposed nist standard for role-based access control. ACM Trans Inf Syst Secur 4(3):224-274
14. Sejong OH, Park S (2003) Task-role-based access control model. Inf Syst 28(6):533-562
15. Di Renzo B, Hillairet M, Picard M, Rifaut A, Bernard C, Hagen D, Maar P, Reinard D (2007) Operational risk management in financial institutions: process assessment in concordance with basel ii. Softw Process 12(4):321-330
16. Chen KL, Shing M-L, Lee H, Shing C-C (2007) Modeling in confidentiality and integrity for a supply chain network. Commun IIMA 7(1):41-48
17. Schaad A, Lotz V, Sohr K (2006) A model-checking approach to analysing organisational controls in a loan origination process. In: SACMAT '06: ACM symposium on Access control models and technologies. ACM, New York, pp 139-149
18. Jaeger T, Sailer R, Zhang X (2004) Resolving constraint conflicts. In SACMAT '04: proceedings of the ninth ACM symposium on access control models and technologies. ACM, New York, pp 105-114
19. Gami N, Mikolajczak B (2007) Integration of multilevel security features into loosely coupled inter-organizational workflows. In: ITNG '07: proceedings of the international conference on information technology. IEEE Computer Society, Washington, DC, pp 653-657
20. Wang L, Wijesekera D, Jajodia S (2004) A logic-based framework for attribute based access control. In: FMSE '04: proceedings of the 2004 ACM workshop on formal methods in security engineering. ACM, New York, pp 45-55
21. Atluri V, Chun SA, Mazzoleni P (2001) A Chinese wall security model for decentralized workflow systems. In: CCS '01: proceedings of the 8th ACM conference on computer and communications security. ACM, New York, pp 48-57
22. Botha RA, Eloff JHP (2001) Separation of duties for access control enforcement in workflow environments. IBM Syst J 40(3):666-682
23. Lu R, Sadiq S (2007) A survey of comparative business process modeling approaches. Springer, Berlin, pp 82-94
24. Wohed P, van der Aalst WMP, Dumas M, ter Hofstede AHM, Russell N (2006) On the suitability of BPMN for business process modelling. In: Proceedings of the 4th international conference on business process management (BPM)
25. Jablonski S, Volz B, Dornstauder S (2008) A meta modeling framework for domain specific process management. In: COMPSAC. pp 1011-1016
26. Wolter C, Miseldine P, Meinel C (2009) Verification of business process entailment constraints using SPIN. In: To appear in international symposium on engineering secure software and systems
27. Zhang Z-L, Hong F, Xiao H-J (2006) Verification of strict integrity policy via petri nets. In: ICSNC '06: proceedings of the international conference on systems and networks communication. IEEE Computer Society, Washington, DC, pp 23
28. Ben-Ari Mordechai (2008) Principles of the spin model checker. Springer, Berlin
29. Goldblatt Robert (1987) Logics of time and computation. Center for the Study of Language and Information, Stanford
30. Tatsubori M, Imamura T, Nakamura Y, (2004) Best-practice patterns and tool support for configuring secure web services messaging. In: ICWS'04: proceedings of the IEEE international conference onweb services. IEEE Computer Society,Washington, DC, p 244
31. Sadiq SW, Governatori G, Namiri K (2007) Modelling control objectives for business process compliance. In: BPM. pp 149-164
32. Mylopoulos J, Chung L, Nixon B (1992) Representing and using nonfunctional requirements: a process-oriented approach. IEEE Trans Softw Eng 18(6):483-497
33. Giorgini P, Massacci F, Zannone N (2005) Security and trust requirements engineering. Lecture Notes in Computer Science. Springer, Berlin, pp 237-272
34. Hepp M, Roman D (2007) An ontology framework for semantic business process management. In: Wirtschaftsinformatik (1). Pp 423-440
35. Nagaratnam N, Nadalin AJ, Hondo M, McIntosh M, Austel P (2005) Business-driven application security: from modeling to managing secure applications. IBM Syst J 44(4):847-868
36. Rodrguez A, Fernández-Medina E, Piattini M (2007) A bpmn extension for the modeling of security requirements in business processes. IEICE Trans 90-D(4):745-752
37. Mossakowski T, Drouineaud M, Sohr K (2003) A temporal-logic extension of role-based access control covering dynamic separation of duties. 00:83
38. Giblin C, Liu AY, Müller S, Pfitzmann B, Zhou X (2005) Regulations expressed as logical models (realm). Technical Report RZ 3616, IBM Research, Zurich, 07
39. Gannod GC, Gupta S (2001) An automated tool for analyzing petri nets using SPIN. ASE 0:404
40. Ouyang C, Verbeek E, van der Aalst WMP, Breutel S, Dumas M, ter Hofstede AHM (2007) Formal semantics and analysis of control flow in ws-bpel. Sci Comput Program 67(2-3):162-198
41. Fisteus JA, Fernández LS, Kloos CD (2005) Applying model checking to BPEL4WS business collaborations. In: SAC '05: proceedings of the 2005 ACM symposium on applied computing. ACM, New York, pp 826-830
42. zur Muehlen M, DT-Y Ho (2005) Risk management in the bpm lifecycle. In: Business process management workshops. pp 454-466
43. Wolter C, Schaad A, Meinel C (2007) Deriving XACML policies from business process models. In: WISE workshops. pp 142-153