Security Constraints in Temporal Role-Based Access-Controlled Workflows (Extended Version)

TL;DR

This paper presents a method to integrate security constraints into temporal role-based access control workflows, enabling dynamic authorization and security enforcement based on temporal and role-based policies.

Contribution

It introduces a novel approach to model and connect workflow and temporal networks for security, along with algorithms for security constraint propagation and safety verification.

Findings

Connected networks remain executable under security constraints

Algorithms effectively propagate security constraints during workflow execution

Method ensures authorized user actions respecting temporal and security policies

Abstract

Workflows and role-based access control models need to be suitably merged, in order to allow users to perform processes in a correct way, according to the given data access policies and the temporal constraints. Given a mapping between workflow models and simple temporal networks with uncertainty, we discuss a mapping between role temporalities and simple temporal networks, and how to connect the two resulting networks to make explicit who can do what, when. If the connected network is still executable, we show how to compute the set of authorized users for each task. Finally, we define security constraints (to prevent users from doing unauthorized actions) and security constraint propagation rules (to propagate security constraints at runtime). We also provide an algorithm to check whether a set of propagation rules is safe, and we extend an existing execution algorithm to take into account these new security aspects.