Injecting RBAC to secure a Web-based workflow system

  • Authors:
  • Gail-Joon Ahn;Ravi Sandhu;Myong Kang;Joon Park

  • Affiliations:
  • ISE Department, MS 4A4, George Mason University, Fairfax, VA;ISE Department, MS 4A4, George Mason University, Fairfax, VA;Naval Research Laboratory, Information Technology Division, Washington, DC;Naval Research Laboratory, Information Technology Division, Washington, DC

  • Venue:
  • RBAC '00 Proceedings of the fifth ACM workshop on Role-based access control
  • Year:
  • 2000

Quantified Score

Hi-index 0.00

Visualization

Abstract

Web-based workflow systems have recently received much attention because they can support dynamic business processes over heterogeneous computing systems. Most existing web-based workflow systems, however, provide minimal security services such as authentication of users and network security. In this paper we describes an experiment in injecting role-based access control (RBAC) into an existing web-based workflow system. Specifically, we ensure that each task can only be executed by users belonging to a specific role. In order to achieve this, we define a simplified RBAC model to meet our needs and describe the security architecture to be applied to an existing web-based workflow system. We describe our implementation using commercial off-the-shelf (COTS) technology to demonstrate the feasibility of this approach. Our implementation uses X.509v3 certificates with role attribute, and employs a user-pull style where the client requests a client certificate from the role-server and presents it to the workflow system. A major goal of our implementation is to have minimal changes to the existing web server and no changes to the browser. We also discuss alternative architecture such as server-pull with LDAP (Lightweight Directory Access Protocol).