Modeling Support for Delegating Roles, Tasks, and Duties in a ...

More documents

Recommendations

Info

6 Sigrid Schefer, Mark Strembecka) Process model including BusinessActions, Duties, and Compensation ActionsCredit application processReassign Duty[Time constraintexpired]Checkapplication formcreditapplication[Formok][else]Check creditworthinessBDuty: Check applicantrating[Checkpassed][else]NegotiatecontractBDuty: Fulfill precontractualdutiescontractcontractApprovecontractBDuty: Review finalcontract[else]Rejectapplication[approved]CreditapplicationBankClerkR{t...t+3}Checkapplicant ratingCA: Reassign DutyDSM. MeyerTask: Check credit worthiness,Negotiate contract,Approve contractDuty: Check applicant rating,Fulfill precontractual duties,Review final contractb) Detailed modelof a Dutyc) Responsibilityand delegationSJ. SmithSummerIntern DRTask: Check credit worthinessDuty: Check applicant ratingFig. 2: Extended credit application processcompleted within three time units (e.g. days) after the corresponding Business-Action has been started. Otherwise, the Compensation Action Reassign Duty isexecuted.The responsibility for the Duties is illustrated in Figure 2c) showing the RoleBankClerk which is assigned to the three BusinessActions and the associated Dutiesdefined in the credit application process. Thus, a Subject assigned to theBankClerk role is responsible for performing these Duties and related BusinessActions.In this example, the Subject M. Meyer is assigned to the BankClerkrole and therefore also needs to discharge the associated Duties. M. Meyer decidesto delegate her Duty Check applicant rating to her summer intern J. Smith.For this purpose, she creates a permanent DelegationRole SummerIntern andassigns the Duty to the DelegationRole. Subsequently, she assigns the SubjectJ. Smith to her DelegationRole SummerIntern. J. Smith is now authorized andresponsible for discharging the Duty Check applicant rating when performing theBusinessAction Check credit worthiness, until either the Duty is revoked fromthe DelegationRole or he loses his assignment to the DelegationRole.4 Related WorkTo the best of our knowledge, this work represents the first attempt to addressdelegation of duties from a business process modeling context. Other approachesusually concentrate on the modeling of authorization constraints. As each dutyholder also needs sufficient authority to perform the assigned duties [13, 15],
Modeling Support for Delegating Roles, Tasks, and Duties 7our approach complements existing approaches. In recent years, there has beenmuch work on various aspects of delegation (see, e.g., [2, 19, 20]), especially ina business process context. In [1], the notion of delegation is extended to allowfor conditional delegation. Different types of constraints, such as authorizationconstraints, are addressed in the context of delegation. The effects of some delegationoperations on three workflow execution models are described in [7]. In [5],the satisfiability problem of workflows while supporting user delegation mechanismsis addressed. Moreover, duties/obligations may also be subject to delegation.However, the delegation of duties has received little attention in literatureso far, although it has been identified as important phenomenon, e.g., in [4],where different ways of delegating obligations are discussed. In [13], some issuesfor delegation of obligations are considered, mainly addressing the reasons fordelegating obligations and the balance between authorizations and obligations.5 ConclusionOur UML2 extension can help organizations to integrate the specification ofprocesses and related access control, obligation, and delegation policies. An integratedmodeling approach yields a number of advantages, such as supportinga proper mapping of models to software systems, facilitating communication betweendifferent stakeholders, making responsibility for tasks and duties explicit,and detecting task- or duty-related conflicts. Moreover, it allows for tracing policyrules to the (regulatory) reasons they exist and to trace them to the softwarecomponents that have to ensure their monitoring and enforcement. This facilitatesthe reporting on a company’s fulfillment of compliance requirements. Wechose to define an extension to the UML2 standard to enable a complete andcorrect mapping between policies, models, and the respective software system.This mapping assures consistency between modeling-level specifications and thesoftware system enforcing respective policies and process instances.References1. V. Atluri and J. Warner. Supporting conditional delegation in secure workflowmanagement systems. In Proceedings of the tenth ACM symposium on Accesscontrol models and technologies (SACMAT), 2005.2. E. Barka and R. Sandhu. A Role-Based Delegation Model and Some Extensions. InProceedings of the 23rd National Information Systems Security Conference (NIS-SEC), 2000.3. E. Barka and R. Sandhu. Framework for Role-Based Delegation Models. In Proceedingsof the 16th Annual Computer Security Applications Conference, 2000.4. J. Cole, J. Derrick, Z. Milosevic, and K. Raymond. Author Obliged to SubmitPaper before 4 July: Policies in an Enterprise Specification. In Proceedings of theInternational Workshop on Policies for Distributed Systems and Networks (POL-ICY), 2001.
Page 1 and 2: Modeling Support for Delegating Rol
Page 3 and 4: Modeling Support for Delegating Rol
Page 5: Modeling Support for Delegating Rol

Modeling Support for Delegating Roles, Tasks, and Duties in a ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?