检索结果-内蒙古大学图书馆

Analysis of authorization constraints via Integer Linear Programming

IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 2023年第3期35卷 2258-2271页

作者： Yang, Benyuan Hu, Hesuan Xidian Univ Sch Electromech Engn Xian 710071 Shaanxi Peoples R China Nanyang Technol Univ Coll Engn Sch Comp Sci & Engn Singapore 639798 Singapore Xi An Jiao Tong Univ State Key Lab Mfg Syst Engn Xian 710054 Shaanxi Peoples R China

This paper focuses on constraint verification and violation resolution for Petri nets (PNs) modeling of role-based access control (RBAC) policy. Checking the satisfiability of authorization constraints imposes a major challenge when the number of states of a target system is large. To overcome this difficulty, we provide three necessary and sufficient conditions to check three different constraints, namely Separation of Duties (SoDs), Binding of Duties (BoDs), and constraints of Cardinality (CoCs). The proposed results are based on the solutions of integer linear programming problems (ILPs). By relying on an ILP formulation that does not require the explicit computation of the net reachability set, the proposed approach is particularly well suited for large-size PNs. When the given system does not satisfy a considered constraint, the objective is to propose a suitable violation resolution strategy to correctly enforce the given constraint. In this paper, enforcement of control places and administration of RBAC are presented to solve the SoD, BoD, and CoC violations. All violations can be corrected in a once for all manner while simultaneously ensuring the satisfaction of all other constraints. The comparison between our approach and the existing ones is given to illustrate the effectiveness and efficiency of ours.

关键词： authorization Blacklisting Mathematical models Petri nets Integer linear programming Optimization Monitoring Role-based access control authorization constraints integer linear programming

来源：评论

学校读者我要写书评

暂无评论

Managing workflow authorization constraints through active database technology

引用

INFORMATION SYSTEMS FRONTIERS 2001年第3期3卷 319-338页

作者： Casati, F Castano, S Fugini, MG Hewlett Packard Labs Palo Alto CA 94304 USA Univ Milan Dipartimento Sci Informaz I-20135 Milan Italy Politecn Milan Dipartimento Elettron & Informaz I-20133 Milan Italy

The execution of workflow processes requires authorizations for enforcing the assignment of tasks to agents. either human or automated, according to the security policy of the organization. This paper presents a workflow authorization framework based on roles and organizational levels, and on authorization constraints. To facilitate the assignment of tasks to agents, roles and organizational levels are organized into hierarchies. authorization constraints are introduced to specify instance-dependent, time-dependent. and history-dependent authorizations. authorization constraints are specified in terms of active rules, used also for authorization management. The Workflow Management System determines authorized agents on the basis of the contents of an authorization base maintained through the active rules defined in the system.

关键词： workflows authorizations authorization constraints roles active databases triggers

来源：评论

学校读者我要写书评

暂无评论

Performance Analysis and Optimization for Stochastic Workflows Running Under authorization constraints 17

Performance Analysis and Optimization for Stochastic Workflo...

引用

IEEE 17th International Conference on Computational Science and Engineering (CSE)

作者： Chang, Cheng He, Ligang Chen, Hao Sun, Jianhua Li, Kenli Hunan Univ Sch Informat Sci & Engn Changsha 410082 Hunan Peoples R China Univ Warwick Dept Comp Sci Coventry CV4 7AL W Midlands England

ISBN: (纸本)9781479979813

Business processes or workflows are often used to model enterprise applications. In the supporting platform for running enterprise applications, authorization policies, such as temporal constraints and role constraints, are often deployed. This paper presents the methods to analyze the impact of authorization policies on the execution of stochastic workflows. Further, we propose a novel authorization method, called SGAA (Stochastic Global Aware authorization), to reduce the impact of authorization policies. Simulation experiments have been conducted to verify the effectiveness of the proposed analysis method and SGAA. The experimental results show that comparing with the intuitive authorization method, SGAA can reduce the delay of workflow execution caused by the authorization constraints.

关键词： stochastic workflows authorization constraints performance analysis

来源：评论

学校读者我要写书评

暂无评论

Role-Based authorization constraints Specification

引用

ACM Transactions on Information and System Security 2000年第4期3.0卷 207-226页

作者： Ahn, Gail-Joon Sandhu, Ravi College of Information Technology University of North Carolina at Charlotte Charlotte NC 28223-0001 9201 University City Blvd. United States Information and Software Engineering Department George Mason University Fairfax VA 22030 Mail Stop 4A4 United States

constraints are an important aspect of role-based access control (RBAC) and are often regarded as one of the principal motivations behind RBAC. Although the importance of constraints in RBAC has been recognized for a long time, they have not received much attention. In this article, we introduce an intuitive formal language for specifying role-based authorization constraints named RCL 2000 including its basic elements, syntax, and semantics. We give soundness and completeness proofs for RCL 2000 relative to a restricted form of first-order predicate logic. Also, we show how previously identified role-based authorization constraints such as separation of duty (SOD) can be expressed in our language. Moreover, we show there are other significant SOD properties that have not been previously identified in the literature. Our work shows that there are many alternate formulations of even the simplest SOD properties, with varying degree of flexibility and assurance. Our language provides us a rigorous foundation for systematic study of role-based authorization constraints. © 2000, ACM. All rights reserved.

关键词： Access control models authorization constraints constraints specification Languages role-based access control Security

来源：评论

学校读者我要写书评

暂无评论

The specification and enforcement of authorization constraints in workflow management systems

引用

ACM Transactions on Information and System Security 1999年第1期2卷 65–104页

作者： Elisa Bertino Elena Ferrari Vijay Atluri Univ. di Milano Milan Italy Rutgers Univ. Newark NJ

In recent years, workflow management systems (WFMSs) have gained popularity in both research and commercial sectors. WFMSs are used to coordinate and streamline business processes. Very large WFMSs are often used in organizations with users in the range of several thousands and process instances in the range of tens and thousands. To simplify the complexity of security administration, it is common practice in many businesses to allocate a role for each activity in the process and then assign one or more users to each role—granting an authorization to roles rather than to users. Typically, security policies are expressed as constraints (or rules) on users and roles; separation of duties is a well-known constraint. Unfortunately, current role-based access control models are not adequate to model such constraints. To address this issue we (1) present a language to express both static and dynamic authorization constraints as clauses in a logic program; (2) provide formal notions of constraint consistency; and (3) propose algorithms to check the consistency of constraints and assign users and roles to tasks that constitute the workflow in such a way that no constraints are violated.

关键词： access control authorization constraints role and user planning

来源：评论

学校读者我要写书评

暂无评论

Analyzing and managing role-based access control policies

引用

IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 2008年第7期20卷 924-939页

作者： Sohr, Karsten Drouineaud, Michael Ahn, Gail-Joon Gogolla, Martin Univ Bremen Ctr Comp Technol D-28359 Bremen Germany Arizona State Univ Dept Comp Sci & Engn Ira A Fulton Sch Engn Tempe AZ 85281 USA

Today, more and more sensitive data is stored on computer systems;security-critical business processes are mapped to their digital counterparts. This situation applies to institutes that have different security requirements, such as the healthcare industry, digital government, and financial service institutes. authorization constraints help the policy architect design and express higher level organizational rules. Although the importance of authorization constraints has been addressed in the literature, a systematic way to verify and validate authorization constraints does not exist. In this paper, we specify both nontemporal and history-based authorization constraints in the Object Constraint Language (OCL) and first-order linear temporal logic (LTL). Based upon these specifications, we attempt to formally verify role-based access control policies with the help of a theorem prover and to validate policies with the UML-based Specification Environment ( USE) system, a validation tool for OCL constraints. We also describe an authorization engine, which supports the enforcement of authorization constraints.

关键词： role-based access control policy authorization constraints linear temporal logic Object Constraint Language

来源：评论

学校读者我要写书评

暂无评论

An access-control framework for WS-BPEL

引用

INTERNATIONAL JOURNAL OF WEB SERVICES RESEARCH 2008年第3期5卷 20-43页

作者： Paci, Federica Bertino, Elisa Crampton, Jason Purdue Univ W Lafayette IN 47907 USA Univ London London WC1E 7HU England

Business processes, the next-generation workflows, have attracted considerable research interest in the last 15 years. More recently, several XML-based languages have been proposed for specifying and orchestrating business processes, resulting in the WS-BPEL language. Even if WS-BPEL has been developed to specify automated business processes that orchestrate activities of multiple Web services, there are many applications and situations requiring that people be considered as additional participants who can influence the execution of a process. Significant omissions from WS-BPEL are the specification of activities that require interactions with humans to be completed, called human activities, and the specification of authorization information associating users with human activities in a WS-BPEL business process and authorization constraints, such as separation of duty, on the execution of human activities. In this article, we address these deficiencies by introducing a new type of WS-BPEL activity to model human activities and by developing RBAC-WS-BPEL, a role-based access-control model for WS-BPEL, and BPCL, a language to specify authorization constraints.

关键词： activity authorization constraints business process permission role

来源：评论

学校读者我要写书评

暂无评论

Supporting authentication requirements in workflows

Supporting authentication requirements in workflows

引用

8th International Conference on Enterprise Information Systems (ICEIS 2006)

作者： Martinho, Ricardo Domingos, Dulce Rito-Silva, Antonio Polytech Inst Leiria Sch Technol & Management P-2411901 Leiria Portugal Univ Lisbon Fac Sci P-1749016 Lisbon Portugal Univ Tecn Lisboa INESC ID Software Engn Grp P-1000029 Lisbon Portugal

ISBN: (纸本)9728865430

Workflow technology represents nowadays significant added value to organizations that use information systems to support their business processes. By their nature, workflows support the integration of different information systems. As organizations use workflows increasingly, workflows manipulate more valuable and sensitive data. Either by interoperability issues or by the value of data manipulated, a workflow may present several and distinct authentication requirements. Typically, information systems deal with their authentication requirements once, within their authentication process. This strategy cannot be easily applied to workflows since each workflow activity may present its own authentication requirements. In this paper we identify authentication requirements that workflows present and we propose to meet these requirements by incorporating authentication constraints into workflow authorization definitions. With this purpose, we extend a generic Role-Based Access Control (RBAC) model and we define an access control algorithm that supports and enforces authorization decisions constrained by authentication information.

关键词： workflow authentication requirements authorization constraints role-based access control

来源：评论

学校读者我要写书评

暂无评论

On the Parameterized Complexity and Kernelization of the Workflow Satisfiability Problem

引用

ACM TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY 2013年第1期16卷 4-4页

作者： Crampton, Jason Gutin, Gregory Yeo, Anders Univ London Dept Math London WC1E 7HU England Univ London Dept Comp Sci London WC1E 7HU England Univ Johannesburg Dept Math Johannesburg South Africa

A workflow specification defines a set of steps and the order in which these steps must be executed. Security requirements may impose constraints on which groups of users are permitted to perform subsets of these steps. A workflow specification is said to be satisfiable if there exists an assignment of users to workflow steps that satisfies all the constraints. An algorithm for determining whether such an assignment exists is important, both as a static analysis tool for workflow specifications and for the construction of runtime reference monitors for workflow management systems. Finding such an assignment is a hard problem in general, but work by Wang and Li [2010] using the theory of parameterized complexity suggests that efficient algorithms exist under reasonable assumptions about workflow specifications. In this article, we improve the complexity bounds for the workflow satisfiability problem. We also generalize and extend the types of constraints that may be defined in a workflow specification and prove that the satisfiability problem remains fixed-parameter tractable for such constraints. Finally, we consider preprocessing for the problem and prove that in an important special case, in polynomial time, we can reduce the given input into an equivalent one where the number of users is at most the number of steps. We also show that no such reduction exists for two natural extensions of this case, which bounds the number of users by a polynomial in the number of steps, provided a widely accepted complexity-theoretical assumption holds.

关键词： Algorithms Security Theory authorization constraints workflow satisfiability parameterized complexity kernelization

来源：评论

学校读者我要写书评

暂无评论

A resilient inter-organizational workflow assignment plan selection approach: Application to a digital health use case

引用

INTERNATIONAL JOURNAL OF ENGINEERING BUSINESS MANAGEMENT 2024年 16卷

作者： Monsef, Boughrous Hanan, El Bakkali Mohammed V Univ Rabat Rabat IT Ctr Smart Syst Lab SSL ENSIAS Rabat Morocco Mohammed V Univ Rabat Rabat IT Ctr Smart Syst Lab SSL ENSIAS Rabat 10000 Morocco

Workflow Management Systems are rapidly evolving and increasingly used in a variety of industries, allowing organizations to automate and enhance their business processes. Hence, they are open to collaboration throw inter-organizational workflows to achieve common objectives. Thus, organizations could thereby adapt to highly dynamic environments and abrupt sudden changes like during epidemics. One of the particular interests for security researchers is to ensure workflow resiliency, which means ensuring the completion of the workflow execution given a defined set of security constraints without violating the security policy. However, the rigid application of security constraints restricts some task-organization assignments, which leads to the workflow satisfiability problem. Moreover, a wise selection of collaborating organizations is very important for secure resilient inter-organizational workflow execution. Therefore, we aim in this paper to propose a resilient inter-organizational workflow assignment plan selection approach to select a valid task-organization plan that allows a resilient inter-organizational workflow complete execution. Our proposed approach, uses the task priority concept, Bayesian inference, and a hybrid multi-criteria decision-making approach based on the methods Analytical Hierarchical Process and Grey Technique for Order of Preference by Similarity to Ideal Solution. As a result, the proposed approach selects the best assignment plan for a resilient execution of the Inter-Organizational Workflow, in addition to delegates for each task-organization assignment if available.

关键词： Inter-organizational workflow assignment plan authorization constraints workflow satisfiability problem workflow resiliency workflow management systems access control collaborative systems

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：