Show description

Arsac et al. pair(Object, F ield)) where Object and F ield have to be replaced with the data objects and fields specified in (S3). 5 Assessment In order to assess our work, we have implemented our approach and formalization within the NW BPM industrial environment which provides, besides others, a Process Composer module that enables process architects and developers (referred in our paper as business analysts) to design and deploy executable BP models. We have enhanced the Process Composer with a Security Validation plug-in that implements our approach and that business analysts can smoothly run to validate security desiderata for the BP under-design.

User executing the task, and the user being delegated. To avoid the violation in Figure 3, the business analyst can think to set role postprocessor as an excluded owner for task inputCustData. Though this prevents the attack trace just presented, the security desiderata are not fulfilled and a new run of the Security Validation plug-in spots a violation where the pre-processing clerk john executes task inputCustData and is then delegated by paul to perform task selectBundledProduct. This new violation stresses the fact that the execution of tasks can be delegated to users of any other role.

The doctor role has the permission to read the medical database both directly and through the nurse role—it would be safe to remove this permission from the doctor role if one wished to minimise the size and complexity of the policy. The two limited hierarchy facts refer to the structure of the role hierarchy. Further, both rely on the concept of an immediate successor, which can be calculated from the RH relation. In an upward limited hierarchy, a role cannot be an immediate successor to two or more roles; in a downward limited hierarchy, two roles cannot be the immediate successor of the same role.