Optimization of workflow access control

1. A computer-implemented method for executing a workflow, wherein the workflow comprises a set of individual activities, the individual activities executable according to alternative execution paths, each of the execution paths through the workflow comprising a plurality of tasks, each task having an associated access policy, the method comprising:

computing a global workflow access type and a partial workflow access type, wherein

the global workflow access type specifies a right to execute all of the individual activities belonging to the workflow, and

the partial workflow access type specifies a right to execute all tasks of a plurality of tasks of a particular path of the alternative execution paths in the workflow based on one or more access policies corresponding to the plurality of tasks, so that the workflow is executable along the particular path;

receiving a request from a user to execute the workflow;

executing an access control based on a workflow access type assigned to the user, wherein

if the user is assigned the global workflow access type, authorizing the user to execute all of the individual activities belonging to the workflow,

if the user is assigned the partial workflow access type, authorizing the user to access all tasks of a corresponding plurality of tasks of the particular path, and

if the user is not assigned the global workflow access type or the partial workflow access type, rejecting the user before executing the workflow.

2. The computer-implemented method of claim 1 , wherein deriving the global workflow access type comprises the operations of:

determining, for each individual activity in the workflow, a set of individual access rules, and

inferring a consolidated access control by aggregating the individual access rules of a particular individual activity.

3. The computer-implemented method of claim 2 , wherein the individual access rules are specified using eXtensible Access Control Markup (XACML).

4. The computer-implemented method of claim 2 , wherein inferring the consolidated access control comprises intersecting individual access constraints, the individual access constraints linked in sequence and further comprises determining partial access constraints for at least a portion of the alternative execution paths in the workflow.

5. The computer-implemented method of claim 1 , wherein an access policy is based on roles.

6. The computer-implemented method of claim 3 , wherein inferring the consolidated access control comprises inferring a minimum role.

7. The computer-implemented method of claim 1 , wherein the workflow is a web service workflow.

8. The computer-implemented method of claim 7 , wherein the web service workflow is specified using Business Process Execution Language for Web Services (BPEL4WS).

9. The computer-implemented method of claim 1 , wherein the individual activities belonging to the workflow are combined using control patterns, wherein the control patterns specify a cumulative (SEQUENCE) execution of the individual activities or alternative (SWITCH) execution of the individual activities.

10. The computer-implemented method of claim 9 , wherein the control patterns that specify the cumulative execution of activities comprise the operators:

flow;

while; and

sequence.

11. The computer-implemented method of claim 9 , wherein the control patterns that specify the alternative execution of activities comprise the operators:

switch; and

pick.

12. A system for executing a workflow wherein the workflow comprises a set of individual activities, the individual activities executable according to alternative execution paths, each of the execution paths through the workflow comprising a plurality of tasks, each task having an associated access policy, the system comprising

an access control module to compute a global workflow access type and a partial workflow access type, wherein

the global workflow access type specifies a right to execute all of the individual activities belonging to the workflow, and

the partial workflow access type specifies a right to execute all tasks of a plurality of tasks of a particular path of the alternative execution paths in the workflow based on one or more access policies corresponding to the plurality of tasks, so that the workflow is executable along the particular path;

an authorization module to receive a request from a user to execute the workflow;

and

a decision module, the decision module having one or more processors to execute instructions embodied on a non-transitory computer-readable medium, to execute an access control based on a workflow access type assigned to the user, wherein

if the user is assigned the global workflow access type, authorizing the user to execute all of the individual activities belonging to the workflow,

if the user is assigned the partial workflow access type, authorizing the user to access all tasks of a corresponding plurality of tasks of the particular path, and

if the user is not assigned the global workflow access type or the partial workflow access type, rejecting the user before executing the workflow.

13. A non-transitory computer-readable medium, comprising instructions that, when executed by a computer or computer network system, cause the computer or the computer network system to perform a method for executing a workflow, wherein the workflow comprises a set of individual activities, the individual activities executable according to alternative execution paths, each of the execution paths through the workflow comprising a plurality of tasks, each task having an associated access policy, the method comprising:

computing a global workflow access type and a partial workflow access type, wherein

the global workflow access type specifies a right to execute all of the individual activities belonging to the workflow, and

the partial workflow access type specifies a right to execute all tasks of a plurality of tasks of at least a particular path of the alternative execution paths in the workflow based on one or more access policies corresponding to the plurality of tasks, so that the workflow is executable along the particular path;

receiving a request from the user to execute the workflow;

executing an access control based on a workflow access type assigned to the user, wherein

if the user is assigned the global workflow access type, authorizing the user to execute all of the individual activities belonging to the workflow, and

if the user is assigned the partial workflow access type, authorizing the user to access all tasks of a corresponding plurality of tasks of the particular path, and

if the user is not assigned the global workflow access type or the partial workflow access type, rejecting the user before executing the workflow.

14. The computer-implemented method of claim 1 , further comprising confirming the access type assigned to the user prior to executing a next activity of the individual activities belonging to the workflow according to the particular path.