SBIR-STTR Award

Historically, businesses have protected assets by mandating prescribed processes and individual responsibilities. Today, vital assets are stored and managed via information systems. Work flow technology, combined with an underlying role-based access control (RBAC) mechanism, is a promising solution for automatically controlling business processes and information assets. Under this Phase 1 effort, we propose to extend RBAC to support workflow constraints. The RBAC model framework that we will start from has been developed on the DARPA Information Assurance Program here at Secure Computing. This innovative RBAC model includes an object-oriented approach to describing the permissions granted to roles. The model has an additional feature of enforcing complex conditions to be satisfied before access can be granted. It is by extending this feature of conditional access that we hope to enforce workflow policies. Our objective is to present a solution that fits existing business practice and is easy to use. In addition to the enhanced RBAC model, we will produce a prototype graphical user interface (GUI) for specifying the workflow security policy by extending the RBAC prototype produced on the Information Assurance Program. The model and the tool will be demonstrated by specifying a sample workflow policy. COMMERCIAL APPLICATIONS: Secure Computing provides a wide family of high security products, including firewalls, web filtering software and authentication servers. One of the primary focuses is to provide centralized management of security components throughout the enterprise. Specifying and enforcing workflow policies accurately and easily is critical to enforcing complex business policies at several different locations. Secure Computing intends to incorporate the workflow technology developed under this program into its suite of network security products

Workflow management systems (WMS) may control access between hundreds of users and thousands of objects, so simplified policy management is critical. WMS developers recommend Role-Based Access Control (RBAC) since roles occur naturally in workflows; however, the typical RBAC model lacks the framework to express workflow policies adequately. Traditionally, a WMS mediates accesses to objects in its workflows. As workflow technology grows in popularity, workflows eventually may control distributed objects such as managed by CORBA and COM/DCOM. Protections must be added to these objects to prevent users from circumventing the WMS and accessing the objects directly. We propose the "Workflow Policy Server" (WPS) to address these challenges. The WPS simplifies workflow policy management with a powerful RBAC Model that has been extended with workflow concepts. In particular, the concept of a workflow task or 'step' has been added. Distributed objects are protected because the WPS can "push out" the access control policy for a specific stop when directed. The WPS translates the step's policy into the enforcement language of the target object manager. COMMERCIAL APPLICATIONS: Secure Computing provides a wide family of high security products, including firewalls, web filtering software and authentication servers. One of the primary focuses is to provide centralized management of security components throughout the enterprise. Specifying and enforcing work flow policies accurately and easily is critical to enforcing complex business policies at several different locations. Secure Computing intends to incorporate the work flow technology developed under this program into its suite of network security products.