Research Article
An Event-Based, Role-Based Authorization Model for Healthcare Workflow Systems
@INPROCEEDINGS{10.1007/978-3-642-23635-8_28, author={Vassiliki Koufi and Flora Malamateniou and Eleni Mytilinaiou and George Vassilacopoulos}, title={An Event-Based, Role-Based Authorization Model for Healthcare Workflow Systems}, proceedings={Electronic Healthcare. Third International Conference, eHealth 2010, Casablanca, Morocco, December 13-15, 2010, Revised Selected Papers}, proceedings_a={E-HEALTH}, year={2012}, month={10}, keywords={healthcare workflow systems role-based authorization least privilege principle ECA rules}, doi={10.1007/978-3-642-23635-8_28} }- Vassiliki Koufi
Flora Malamateniou
Eleni Mytilinaiou
George Vassilacopoulos
Year: 2012
An Event-Based, Role-Based Authorization Model for Healthcare Workflow Systems
E-HEALTH
Springer
DOI: 10.1007/978-3-642-23635-8_28
Abstract
Authorization and access control is of primary importance to workflow healthcare environments. Although task dependencies in the workflow give rise to the need for a specific ordering of task executions, it is authorization that determines who can execute the various tasks that comprise the workflow and what information can be accessed during task executions. Furthermore, a challenge of workflow security is to enforce the least privilege principle (i.e. users must be allowed to receive the least possible permissions required to perform a task) throughout workflow execution in order to reduce the risk of compromising information integrity during task executions. However, adherence to the least privilege principle often requires the enforcement of dynamic, contextual constraints so that authorizations for access to data during task executions are granted to and revoked from users dynamically. This paper discusses an event-based, role-based workflow authorization model and mechanism that addresses this issue. In particular, the model augments the capabilities of traditional role-based access control (RBAC) models by allowing user roles to change dynamically during workflow execution based on the occurrence of specific events, in order to prevent users from acquiring unnecessary privileges during workflow task executions and, hence, synchronizing authorization flow with the progression of the workflow.
