SOWAC: a service-oriented workflow access control model

Workflow access control is the fundamental issue in workflow security. With the development of enterprise globalization and the constant re-engineering and optimizing of enterprise business, the organization becomes more dynamic and its business process is frequently changing. As a result, workflow access control turns more complicated and entails a comparatively operational mechanism. To solve the problem, in view of decoupling workflow access control model from workflow model, we propose a service-oriented workflow access control (SOWAC) model in this paper. In the SOWAC model, service is the abstraction of a task and the unit for applying access control. We present the elements of the SOWAC model and illustrate the enforcement of SOWAC with an example workflow. Then the dynamic separation of duty for the SOWAC model is proposed based on the authorization history of services. By applying SOWAC in a real workflow management system, we show that the SOWAC model is practical and effective.