An extension approach that supports attribute based access control for WS-BPEL

Business processes, the next-generation workflows, have attracted considerable interest in recent years. Several XML-based languages have been proposed for specifying and orchestrating business processes. WS-BPEL (Web Services Business Process Execution Language), which is widely used in business process specification, cannot support authorization policies on the execution of activities. In this paper, we propose an approach that extends WS-BPEL with ABAC (Attribute Based Access Control) model to satisfy the access control requirements of business processes. We introduce an access control framework for Web services in business processes, and through integrating ABAC and WS-BPEL, we make it possible to make access control policies for business processes.