Modeling and analyzing the impact of authorization on workflow executions

详细信息	查看全文 | 推荐本文 |

• 作者：Ligang He^a ; ^{liganghe@dcs.warwick.ac.uk}  ; [Author Vitae] ; Chenlin Huang^b  ; [Author Vitae] ; Kewei Duan^c  ; [Author Vitae] ; Kenli Li^d  ; [Author Vitae] ; Hao Chen^d  ; [Author Vitae] ; Jianhua Sun^d  ; [Author Vitae] ; Stephen A. Jarvis^a  ; [Author Vitae]
• 关键词：Modeling ; Authorization ; Workflow ; RBAC
• 刊名：Future Generation Computer Systems
• 出版年：2012
• 期刊代码：54_0167739x
• 类别：cp
• 出版时间：October, 2012
• 卷：28
• 期：8
• 页码：1177-1193
• 文件大小：1081 K

摘要

It has been a subject of a significant amount of research to automate the execution of workflows (or business processes) on computer resources. However, many workflow scenarios still require human involvement, which introduces additional security and authorization concerns. This paper presents a novel mechanism for modeling the execution of workflows with human involvement under Role-based Authorization Control. Our modeling approach applies Colored Timed Petri-Nets to allow various authorization constraints to be modeled, including role, temporal, cardinality, BoD (Binding of Duty), SoD (Separation of Duty), role hierarchy constraints etc. We also model the execution of tasks with different levels of human involvement and as such allow the interactions between workflow authorization and workflow execution to be captured. The modeling mechanism is developed in such a way that the construction of the authorization model for a workflow can be automated. This feature is very helpful for modeling large collections of authorization policies and/or complex workflows. A Petri-net toolkit, the CPN Tools, is utilized in the development of the modeling mechanism and to simulate the constructed models. This paper also presents the methods to analyze and calculate the authorization overhead as well as the performance data in terms of various metrics through the model simulations. Based on the simulation results, this paper further proposes the approaches to improving performance given the deployed authorization policies. This work can be used for investigating the impact of authorization, for capacity planning, for the design of workload management strategies, and also to estimate execution performance, when human resources and authorization policies are employed in tandem.