Access Control Policies for Cross-Organizational Workflow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cross-organizational workflow environments, managing access privileges and ensuring the integrity of workflow processes is challenging due to complexity and the constant addition of new participants, leading to potential unauthorized or malicious activity execution.
Innovation Solution
A method and system that classify activities into types and generate control policies to determine participant interactions, using Policy Decision Points (PDPs) and Policy Enforcement Points (PEPs) to enforce access control based on role-based and identity-based policies, ensuring only authorized participants can trigger activities and maintain workflow integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If workflow management involves multiple participants across organizations, then collaborative capability and resource sharing are improved, but access control complexity and security risks increase
Solution Approach 1:
The access control system is segmented into distinct components: Policy Decision Points (PDPs) that evaluate requests and Policy Enforcement Points (PEPs) that enforce decisions. This segmentation allows complex cross-organizational access control to be divided into manageable, distributed units that can operate independently across organizational boundaries.
Solution Approach 2:
A central access control server acts as an intermediary between requesting participants and responding participants. This intermediary component receives access requests, evaluates them against defined policies, and returns authorization decisions, thereby mediating the complexity of direct peer-to-peer access control in multi-organizational environments.
2Adaptability or versatility
If new participants constantly join the collaborative environment, then organizational flexibility and scalability are improved, but verification of identity and access privileges becomes more difficult
Solution Approach 1:
Access control policies are defined and registered in advance before participants join or before they attempt to access resources. These pre-defined policies specify the required trust levels and authorization conditions, allowing the system to automatically verify new participants against established criteria without requiring manual verification procedures.
3Productivity
If participants can trigger execution activities freely, then workflow efficiency and productivity are improved, but integrity and security of the process are compromised
Solution Approach 1:
The system implements a feedback mechanism where access requests are continuously evaluated against defined policies, and authorization decisions are returned to control the execution activities. This feedback loop ensures that even though participants can trigger activities, their actions are continuously monitored and controlled based on their verified identity and trust level, maintaining both efficiency and integrity.
Data Source
AI summary
A method and system to control an interaction of a plurality of participants in a workflow process. The method classifies the plurality of activities as (1) first activity of the workflow process, (2) first activity of a participant in an on-going workflow process, and (3) interaction activity. A set of access control policies is generated for each type of activity. The policies include workflow initialization policy, participation policy and interaction policies. The policies determine if a requesting participant is permitted to interact with a responding participant. In addition, the system includes a policy enforcement point for receiving a request from a requesting participant, wherein the request is for activating an activity of a responding participant. The policy enforcement point forwards the request to a policy decision point where the request is evaluated based on the set of access control policies.