| Workflow management systems (WFMS) are typically employed to provide the functionality for automating business activities. WFMS represent an important, inter-disciplinary area which is commercially significant, as witnessed by the large number of available products and a number of WFMS supported applications in various commercial sectors. The widespread use of workflow applications has lead to increased awareness of data security issues. This dissertation identifies the specific access control requirements--both discretionary and mandatory--in WFMS and proposes suitable security models. It also proposes a formal framework, based on Petri nets (PNs), to facilitate modeling and analyzing the security properties of WFMS. This dissertation has contributed to the progress towards the formalization, validation, development of workflow security models. The specific technical achievements are as follows: (1) With respect to the issue of discretionary access control, this dissertation proposes a workflow authorization model (WAM) that provides necessary features such as support for synchronization of an authorization flow with a workflow, separation of duties, and event-based authorization. (2) With respect to the issue of mandatory access control, this dissertation considers a multilevel secure (MLS) workflow environment and proposes a semantics-based classification to redesign MLS workflows. The redesigning ensures that all task dependencies can be executed correctly and securely and the redesigned workflow is equivalent to the original workflow. (3) This dissertation proposes a PN-based modeling and analysis approach as well as implements a working prototype for the proposed security model. Specifically, (a) it provides a uniform representation for specifying both discretionary and mandatory access control in workflows, (b) it is capable of testing correctness of workflow dependency specifications by testing whether there exists inconsistent dependencies, (c) it is capable of examining the temporal feasibility, given an initial starting time of a workflow, and (d) it conducts a PN-based safety analysis. |
