Preventing information leakage within workflows that execute among competing organizations

Journal of Systems and Software

Volumn 75, Issue 1-2, 2005, Pages 109-123

  Chou, Shih Chien ^a   Liu, An Feng ^a   Wu, Chien Jung ^a  

^a NATIONAL DONG HWA UNIVERSITY   (Taiwan)

Author keywords

Access control; Access control list (ACL); Prevent information leakage; Security; Workflow

Indexed keywords

CRYPTOGRAPHY; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; MATHEMATICAL OPERATORS; SECURITY OF DATA; SENSITIVITY ANALYSIS; SOCIETIES AND INSTITUTIONS;

ACCESS CONTROL; ACCESS CONTROL LIST (ACL); PREVENT INFORMATION LEAKAGE; SECURITY; WORKFLOW;

INFORMATION ANALYSIS;

EID: 9544241320     PISSN: 01641212     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jss.2004.01.003     Document Type: Article

References (37)

1. Ahn, G.J., Sandhu, R., Kang, M., Park, J., 2000. Injecting RBAC to secure a web-based workflow system. In: Proceedings of the 5th ACM Workshop on Role-Based Access Control.
2. Atluri, V., Chun, S.A., Mazzoleni, P., 2001. A Chinese wall security model for decentralized workflow systems. In: Proceedings of the 8th ACM Conference on Computing and Communication Security, 2001.
3. Basin, D., Doser, J., Lodderstedt, T., 2003. Model driven security for process-oriented systems. In: Proceedings of the Eighth ACM Symposium on Access Control Models and Applications, pp. 100-109.
4. Bertino, E., Ferrari, E., Atluri, V., 1997. A flexible model supporting the specification and enforcement of role-based authorizations in workflow management systems. In: Proceedings of the 2nd ACM Workshop on Role-Based Access Control.
5. Dong, X., Chen, G., Yin, J., Dong, J., 2002. Petri-net-based context-related access control in workflow environment. In: Proceedings of the 7th International Conference on Computer Suported Cooperative Work in Design.
6. Ford, W., Baum, M.S., 2001. Secure Electronic Commerce, second ed. Prantice-Hall.
7. Georgakopoulos, D., Hornick, M., Sheth, A., 1995. An overview of workflow management: from process modeling to workflow automation infrastructure. Distributed and Parallel Databases 3, 119-153.
8. Harrison, M.H., Ruzzo, W.L., Ullman, J.D., 1976. Protection in operating systems. Communications of the ACM 19 (8), 461-471.
9. Hung, P.C.K., Karlapalem, K., 2003. A secure workflow model. In: Proceedings of the 2003 Australasian Information Security Workshop, pp. 33-41.
10. Kang, M.H., Eppinger, B.J., Froscher, J.N., 1999a. Tools to support secure enterprise computing. In: Proceedings of the 15th Annual Computer Security Application Conference.
11. Kang, M.H., Froscher, J.N., Sheth, A.P., Kochut, K.J., 1999b. A multilevel secure workflow management system. In: Proceedings of 11th Conference on Advanced Information Systems Engineering.
12. Kang, M.H., Park, J.S., Froscher, J.N., 2001. Access control mechanisms for inter-organizational workflow. In: Proceeding of the 6th ACM Symposium on Access Control Methods and Technologies.
13. Knorr, K., 2000. Dynamic access control through petri net workflows. In: Proceedings of the 16th Annual Conference on Computer Security Application.
14. Myers, A.C., 1999. JFlow: practical mostly-static information flow control. In: Proceedings of the 26th ACM Symposium on Principles of Programming Language, pp. 228-241.
15. Myers, A.C., Liskov, B., 1997. A decentralized model for information flow control. In: Proceedings of the 17th ACM Symposium on Operating Systems Principles, pp. 129-142.
16. Myers, A., Liskov, B., 1998. Complete, safe information flow with decentralized labels. In: Proceedings of the 14th IEEE Symposium on Security and Privacy, pp. 186-197.
17. Myers, A., Liskov, B., 2000. Protecting privacy using the decentralized label model. ACM Transactions on Software Engineering and Methodology 9 (4), 410-442.
18. Nyanchama, M., Osborn, S., 1994. Access rights in role-based security systems. In: Database Security VIII: Status and Prospects, pp. 37-56.
19. Olivier, M.S., van de Riet, R.T., Gudes, E., 1998. Specifying application-level security in workflow systems. In: Proceeding of the 9th International Workshop on Database and Expert Systems Applications, pp. 346-351.
20. Oracle, 2003a. Available from 〈http://www.oracle.com〉.
21. Oracle, 2003b. Available from 〈http://sqlzoo.napier.ac.uk/big/ B10501_01/workflow.920/a95265/toc.htm〉.
22. Park, J.S., Hwang, J., 2003. Role-based access control for collaborative enterprise in peer-to-peer computing environments. In: Proceedings of the Eighth ACM Symposium on Access Control Models and Applications, pp. 93-99.
23. Payne, C., Thomsen, D., Bogle, J., O'Brien, R., 1999. Napoleon: a recipe for workflow. In: Proceedings of the 15th Computer Security Applications Conference, pp. 134-142.
24. Rumbaugh, J., Jacobson, I., Booch, G., 1999. The Unified Modeling Language Reference Manual. Addison-Wesley.
25. Sandhu, R., 1996. Role hierarchies and constraints for lattice-based access controls. In: Proceedings of the Fourth European Symposium on Research in Computer Security, pp. 65-79.
26. Sandhu, R., Bhamidipati, V., Munawer, Q., 1999. The ARBAC97 model for role-based administration of roles. ACM Transaction on Information and System Security 2 (1), 105-135.
27. Sandhu, R.S., Coyne, E.J., Feinstein, H.L., Youman, C.E., 1996. Role-based access control models. IEEE Computer 29 (2), 38-47.
28. SAP, 2003. Available from 〈http://www.sap.com〉.
29. Silberschatz, A., Galvin, P.B., Gagne, G., 2002. Operating System Concepts, sixth ed. John Wiley & Sons.
30. Thatte, S., 2002. Specification: Business Process Execution Language for Web Services, Version 1.1. Available from 〈http://www-106.ibm.com/ developerworks/webservices/library/ws-bpel/〉.
31. Thomas, R.K., Sandhu, R.S., 1997. Task-based authorization controls (TBAC): a family of models for active and enterprise-oriented authorization management. In: Proceedings of the IFIP WG11.3 Workshop on Database Security.
32. Thomsen, D.J., 1991. Role-based application design and enforcement. In: Database Security IV: Status and Prospects, pp. 151-168.
33. Thomsen, D., O'Brien, D., Bogle, J., 1998. Role based access control framework for network enterprises. In: Proceedings of the 14th Annual Computer Security Applications Conference.
34. WfMC, 2003. Available from 〈http://www.wfmc.org〉.
35. Wietrzyk, V.I., Takazawa, M., Orgun, M.A., Varadharajan, V., 2001. A secure transaction environment for workflows in distributed systems. In: Proceedings of the Eighth International Conference on Parallel and Distributed Systems, pp. 198-205.
36. WSBPEL, 2003. Available from 〈http://www.collaxa.com/home.index. jsp〉.
37. Yu, M., Liu, P., Zang, W., 2003. Multi-version attack recovery for workflow systems. In: Proceedings of the 19th Annual Computer Security Applications Conference, pp. 142-151.