The Research & Design Of The Workflow Security System

Workflow Management System (WFMS) is the software to design, analyze, optimize, and automate the business processes. In recent years, much energy has been spent in research of WFMS, and deep research is done on the definition, divert and figuration of workflow so that considerable fruits are obtained. However, the security of workflow and WFMS is rarely concerned. Similar to springtime of Internet, security problems exist in WFMS, but it hasn't been outstanding yet. In fact, WFMS has requirements of security on many aspects, such as access control, authentication, signature, cryptograph etc.There are many platforms to select to develop WFMS, each with its advantages and shortages. Among those the java platform has the unique advantage of platform- independence and migrate-ability. J2EE is a good platform to develop WFMS. It provides comprehensive security services and corresponding modules. It's easy to develop security software on the J2EE platform with JCE.A lot of achievements have been made in information security. In cryptography, many algorithms for encrypting and signature are invented. But there are many problems in authentication and access control yet. The familiar manner of identity authentication is all based on the relative fixable secret information. According to the limitation, this paper brings forward the idea of Growable Authentication, which is based on the active information, can use the method of information validation in all sorts of existing identity authentication and resist the familiar attack of identity authentication such as wiretapping, replay, cryptanalysis etc. The familiar manner of access control has Role Based Access Control (RBAC) and User Based Access Control (UBAC). Aiming at the peculiarity of unknown user number in workflow safety system, this paper bring forward a kind of mixed access control model which can warrant not only to user, but also to role.