liu.seSearch for publications in DiVA
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Workflow management systems, their security and access control mechanisms
Linköping University, Department of Electrical Engineering.
2007 (English)Independent thesis Advanced level (degree of Master (Two Years)), 20 credits / 30 HE creditsStudent thesis
Abstract [en]

This paper gives an overview of workflow management systems (WfMSs) and their security requirements with focus on access mechanisms. It is a descriptive paper in which we examine the state of the art of workflow systems, describe what security risks affect WfMSs in particular, and how these can be diminiuished.

WfMSs manage, illustrate and support business processes. They contribute to the performance, automation and optimization of processes, which is important in the global economy today. The security of process flows is important, since the sensitive business data need to be protected to inhibit illegal activities, such as blackmailing, imitation and fraud and to provide for good customer service.

This paper focuses on access mechanisms, because they are basic security mechanisms used by WfMSs assuring that only authorized users are provided access to data and resources. Also because of the unsecurity of the Internet, which is commonly used as infrastructure of Workflow systems, additional security mechanisms, such as PKIs, digital signatures and SSL have to be used to provide secure workflows.

Depending on the particular requirements in workflow systems, different extensional access control (AC) mechanisms have been developed to maintain security. But when it comes to commercially used WfMSs, the availability of the system is of utmost importance. It is the prerequisite for the system to be employed by companies. The problem is that there is always a trade-off between availability of the system and security. Because this trade off is generally solved in favor of availability, a major part of the developed AC mechanisms are not used in commercially used WfMS.

After the first part of this paper which is rather theoretical, we examine a commercial WfMS, namely IBM's MQ Workflow , and its security mechanisms. We show vulnerabilities of the system that could be abused by attackers. Afterwards, we show which security mechanisms, in particular, AC mechanisms are provided to secure against threats. We conclude with a summary, which highlights the difference between security concepts developed in the research area and those really implemented by the commercially used WfMS.

Place, publisher, year, edition, pages
2007. , 96 p.
Keyword [en]
workflow management systems, access control mechanisms
National Category
Computer Engineering
Identifiers
URN: urn:nbn:se:liu:diva-15933ISRN: LiTH-ISY-EX-2008/4240-SEOAI: oai:DiVA.org:liu-15933DiVA: diva2:128401
Presentation
(English)
Uppsok
teknik
Supervisors
Examiners
Available from: 2008-12-19 Created: 2008-12-16 Last updated: 2009-03-10Bibliographically approved

Open Access in DiVA

fulltext(0 kB)2780 downloads
File information
File name FULLTEXT01.pdfFile size 0 kBChecksum SHA-512
dd32d808b72e122a6a83930b1ce804dd8e861da4b6ce47d93373467223dfa28949dc1a8aaf91b58cc7cb13e17b1901727be7dbc79a150d417ac6b9f0d4c123b6
Type fulltextMimetype application/pdf

Search in DiVA

By author/editor
Chehrazi, Golriz
By organisation
Department of Electrical Engineering
Computer Engineering

Search outside of DiVA

GoogleGoogle Scholar
Total: 2780 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 339 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf