Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

execution in a distributed manner. For thispurpose, we define an algorithm to generatethe local security policy associated with theexecution of each task that composes theworkflow. The global policy and the petri netmodel associated with the workflow executionare provided as inputs of the algorithm [4].Our approach differs from previous works bydefining a dynamic management of workflowauthorizations and by considering a securitypolicy that takes into account information flowcontrol. This approach based on the DTEmodel is more robust and flexible than the MLS(Multi-Level Security) approach used in otherworks.ConclusionUntil now, we have presented a petri netbased model for moddeling workflows and wehave defined the associated security policy.This model and security policy are based onOrBAC concepts. Thus, they reuse organizationand context notions defined in this accesscontrol model. Our security policy takes intoaccount different temporal constraints betweentwo tasks. It is composed of a general securitypolicy, a coordination security policy and aninformation flow control policy. In a secondpart, we have presented an algorithm allowingus to synchronize authorization flows withworkflow execution. This algorithm defineshow to execute the suggested model in adistributed WFMS environment.As part of future work, we shall enrich ouralgorithm by handling information flowsbetween different organizations. Indeed,organizations must exchange flows to haveknowledge of what is happening globally in thesystem. These flows must be managed inorder to keep a secure execution environmentof the process. Exchanging flows betweenorganizations must be compliant with theconfinement principle. Thus, these exchangeshave to be controlled in order to keep a secureenvironment of execution processes.References[1] Workflow Management Coalition. WorkflowSecurity Considerations. White Paper.Document number WFMC-TC-1019, DocumentStatus – Issue 1.0. 1998.[2] Samiha Ayed, Nora Cuppens-Boulahia,Frédéric Cuppens. Deploying Access Control inDistributed Workflow. Australian InformationSecurity Conference, Wollongong, Australia(AISC), January 2008.[3] Samiha Ayed, Nora Cuppens-Boulahia,Frédéric Cuppens. An integrated model foraccess control and information flowrequirements. 12th Annual Asian ComputingScience Conference Focusing on SecureSoftware and Related Issues (ASIAN), Doha,Qatar, December 2007.[4] Samiha Ayed, Nora Cuppens-Boulahia,Frédéric Cuppens. Managing access and flowcontrol requirements in distributed workflows.6th ACS/IEEE International Conference onComputer Systems and Applications (AICCSA)Doha, Qatar, March 2008.PROTEKTO : Security platform for content providersResearch Staff : Nora et Frédéric Cuppens, François WangKeywords : Authentication, Authorization, OpenId, SAML, OrBACApplications : Secure content managementPartners & Funding : Partial funding in the framework of Carnot institutesIntroductionThe Protekto project's goal is to create aplatform for content providers which integratesthe recent technologies for authentication andauthorization, capitalising on TélécomBretagne work and competences of the SWIDcompany. Regarding authentication, Protektowill use the OASIS standard SAML 2.0(Security Assertion Markup Language) [1] andthe OpenID 2.0 protocol (seehttp://openid.net/developers/specs/) adoptedby users. And for the authorization part of38 Extract of Pracom’s Annual Report 2008