Access control needs in an electronic workflow environment

Abstract

This paper defines an electronic workflow environment as being conducive to the performance of business processes according to certain policies and practices in an electronic fashion. The workflow procedure will be facilitated by the flow of information (frequently contained in non-structured or semi-structured documents) on different routes between business roles according to certain rules. It is important that a business should be able to trust the information which is distributed through and generated in the workflow mechanism. Information security therefore is an extremely important aspect in the electronic workflow environment. The protection of the integrity of the information can be considered one of the principle building blocks in securing the environment. It is furthermore important to be able to prove that the information is authentic. The controls exercised by the electronic workflow environment should be able to keep information from being disclosed to unauthorized parties. Access control is, therefore, an important aspect, however the success of all access control mechanisms is reliant on the availability of authenticated identities. This paper evaluates the access control needs of the electronic workflow environment by studying the burdens that each of the components of the workflow environment places on the access control mechanism. The needs are illustrated by referring to electronic documents as one of the principle communication mechanisms in the workflow environment. Subsequently a checklist for the access control needs of the electronic workflow environment is presented. The paper then presents certain access control mechanisms and techniques that are frequently used. These are evaluated for use in an electronic workflow environment in terms of the presented checklist. This paper provides proof that conventional access control mechanisms and their related management techniques are insufficient for the much more dynamic electronic workflow environment.