Method and a system for a secure execution of workflow tasks of a workflow in a decentralized workflow system
Secure execution of workflow tasks are executed according to a given execution pattern in a decentralized workflow system with a central workflow engine and multiple task execution agents. The method starts at an i'th execution agent which is selected by at least one preceding execution agent in accord with the execution pattern to perform an i'th task of the workflow. The method includes receiving, from the at least one preceding execution agent via a secure channel, a task-based private key generated by the at least one preceding execution agent, signing workflow information of the workflow for at least one subsequent execution agent with a workflow signature, selecting at least one appropriate subsequent execution agent, computing a task-based private key for the at least one subsequent execution agent, and forwarding to the at least one subsequent execution agent the workflow information with its associated workflow signature.
1. A computer-implemented method for a secure execution of workflow tasks of a workflow, the computer-implemented method comprising:
receiving, from a preceding execution agent, a task-based private key generated by the preceding execution agent;
signing workflow information of a workflow for a subsequent execution agent with a workflow signature, the workflow signature being computed using a workflow signature scheme by taking as input at least the task-based private key;
forwarding to the subsequent execution agent the workflow information with its associated workflow signature; and
computing the task-based private key for the subsequent execution agent, the task-based private key being computed using system parameters and a workflow identifier assigned to the subsequent execution agent, the workflow information further being forwarded with the task-based private key.
2. The computer-implemented method of claim 1 , wherein the task-based private key is produced using the workflow signature scheme.
3. The method according to claim 1 , wherein the workflow identifier assigned to the subsequent execution agent is chosen as a concatenation of actual execution agent identifiers in a path from a central workflow engine to an i'th execution agent and further to the subsequent execution agent according to the workflow.
4. The method according to claim 1 , the method further comprising establishing a secret value to be used to compute the task-based private key for the subsequent execution agent.
5. The method according to claim 1 , the method further comprising constructing a remaining workflow for the subsequent execution agent after an i'th execution agent has completed its task.
6. The method according to claim 1 , the method further comprising verifying a workflow signature that is received from the preceding execution agent by using signed workflow information that is received from the preceding execution agent, a workflow identifier assigned to an i'th execution agent and system parameters as input.
7. The method according to claim 1 , the method further comprising authenticating system parameters that are received from the preceding execution agent.
8. The method according to claim 1 , the method further comprising passing on to the subsequent execution agent also the workflow signatures that an i'th execution agent received from previous execution agents.
9. The method according to claim 1 , wherein forwarding to the subsequent execution agent the workflow information with its associated workflow signature further includes forwarding, with the workflow information and its associated workflow signature, system parameters and a task-based private key for the subsequent execution agent through a secure channel, the task-based private key being computed using the system parameters and a workflow identifier assigned to the subsequent execution agent.
10. A computer-implemented system, comprising:
a plurality of task execution agents, the plurality of task execution agents including an i'th execution agent, the i'th execution agent implemented by one or more processors and configured to:
receive, from a preceding execution agent from the plurality of task execution agents, a task-based private key generated by the preceding execution agent;
sign workflow information of a workflow for a subsequent execution agent with a workflow signature, the workflow signature being computed using a workflow signature scheme by taking as input at least the task-based private key; and
forward, to a subsequent execution agent from the plurality of task execution agents, the workflow information with its associated workflow signature;
wherein the i'th execution agent is further configured to compute the task-based private key for the subsequent execution agent, the task-based private key being computed using system parameters and a workflow identifier assigned to the subsequent execution agent, the workflow information further being forwarded with the task-based private key.
11. The computer-implemented system of claim 10 , wherein the task-based private key is produced using the workflow signature scheme.
12. The system according to claim 10 , wherein the workflow identifier assigned to the subsequent execution agent is chosen as a concatenation of actual execution agent identifiers in a path from a central workflow engine to the i'th execution agent and further to the subsequent execution agent according to the workflow.
13. The system according to claim 10 , wherein the i'th execution agent is further configured to establish a secret value to be used to compute the task-based private key for the subsequent execution agent.
14. The system according to claim 10 , wherein the i'th execution agent is further configured to construct a remaining workflow for the subsequent execution agent after the i'th execution agent has completed its task.
15. The system according to claim 10 , wherein the i'th execution agent is further configured to verify a workflow signature that is received from the preceding execution agent by using signed workflow information that is received from the preceding execution agent, a workflow identifier assigned to the i'th execution agent and system parameters as input.
16. The system according to claim 10 , wherein the i'th execution agent is further configured to authenticate system parameters that are received from the preceding execution agent.
17. The system according to claim 10 , wherein the i'th execution agent is further configured to pass on to the subsequent execution agent also the workflow signatures that the i'th execution agent received from previous execution agents.
18. A non-transitory computer-readable medium storing executable instructions thereon, which, when executed by a processor, cause the processor to perform operations comprising:
receiving, from a preceding execution agent from a plurality of task execution agents, a task-based private key generated by the preceding execution agent;
signing workflow information of a workflow for a subsequent execution agent with a workflow signature, the workflow signature being computed using a workflow signature scheme by taking as input at least the task-based private key;
forwarding, to a subsequent execution agent from the plurality of task execution agents, the workflow information with its associated workflow signature; and
computing the task-based private key for the subsequent execution agent, the task-based private key being computed using system parameters and a workflow identifier assigned to the subsequent execution agent, the workflow information further being forwarded with the task-based private key.