Specifying Separation of Duty Constraints in BPEL4People Processes

Abstract. Security issues have to be carefully considered for information systems that support the business processes of an organization, in particular, when these systems build on open interfaces such as web services. In this paper, we examine the new BPEL extension BPEL4People from an access control perspective. In particular, we discuss the importance of "separation of duty" constraints and identify options to specify such constraints in BPEL4People processes. Moreover, we identify and discuss shortcomings of the BPEL4People specifications that complicate and/or impede separation of duty enforcement. In addition, we suggest solutions which can be introduced into future versions of BPEL4People to mitigate those shortcomings.

• Type: Conference
• Year: 2008
• Where: BIS
• Authors: Jan Mendling, Karsten Ploesser, Mark Strembeck
• Keywords: BIS 2008, Bpel Extension Bpel4people, BPEL4People, BPEL4People Processes, Business