Systematic Design and Realization of Security-Critical Inter-Organizational Workflows

The implementation of secure inter-organizational workflows can currently only be done by experts with a highly specialized knowledge and security goals are often not adjusted with the customers´ needs. In this paper we present a method for the design and realization of security-critical inter-organizational workflows focusing on the thorough elicitation of security requirements at different abstraction levels that is aimed to be used by domain experts. The method is based on two orthogonal views. The interface view describes each partner as a component offering a set of services with given properties and permissions. The workflow view describes the orchestration of these services both at a global and at a local level. The realization is based on a reference architecture comprising the local control of workflow instances, components realizing security requirements and web services implementing the business logic.