Modeling and Realizing Security-Critical Inter-Organizational Workflows

In this paper we present a method for the design and realization of security-critical inter-organizational workflows. We focus on the systematic development of secure solutions based on the thorough elicitation of security requirements. Our basic view is a network of partners cooperating in a controlled way by calling services and exchanging documents. The method presented is based on two orthogonal views. In the interface view each partner is seen as a component offering a set of services with given properties and permissions. In the workflow view the orchestration of these services is defined both at a global and at a local level. Our approach is based on a reference architecture that allows the local control of workflow instances. Security requirements are realized by security components and web services implementing the business logic.