Policy-Based Access Control Approach to Staff Activities of a Business Process

• US 20080263060A1
• Filed: 04/23/2007
• Published: 10/23/2008
• Est. Priority Date: 04/23/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Madduri, Hari Haranath, Benantar, Messaoud B.
• Granted Patent: US 8,904,391 B2
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: G06F 16/367 Ontology
• CPC Class Codes: G06F 9/4492 Inheritance
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/06311 Scheduling, planning or task assignment for a person or group
• CPC Class Codes: G06Q 10/063118 Staff planning in a project environment
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management

Abstract

A computer implemented method, data processing system, and computer program product for dynamically binding business process activities to human entities at deployment time. Identification information about a staff activity in a business process is received from a process server at an access control system external to the process server. Responsive to initiation of the business process, the staff activity is resolved at the access control system at runtime by assigning the staff activity to a user based on an access policy of the access control system to form a staff activity assignment. The staff activity assignment is communicated from the access control system to the process server. The process allows the development of the business process to be entirely decoupled from staff activity resolution at runtime.

Claims

1. A computer implemented method for dynamically assigning a staff activity to a human entity or organizational role, the computer implemented method comprising:

receiving, from a process server, identification information about a staff activity in a business process at an access control system external to the process server;

responsive to initiation of the business process, resolving the staff activity at the access control system at runtime by assigning the staff activity to a user based on an access policy of the access control system to form a staff activity assignment; and

communicating the staff activity assignment from the access control system to the process server;

wherein the receiving, resolving, and communicating steps enable development of the business process to be decoupled from staff activity resolution at runtime.

2. The computer implemented method of claim 1, wherein the process server provides the staff activity assignment to the user.

3. The computer implemented method of claim 1, wherein the staff activity assignment is provided to the user in response to the user logging onto the process server.

4. The computer implemented method of claim 1, wherein resolving the staff activity at the access control system further includes:

examining membership of the user in an organizational group or role; and

assigning the staff activity to the user based on the user'"'"'s membership.

5. The computer implemented method of claim 1, wherein the user is one of a human entity, organizational group, or organizational role.

6. The computer implemented method of claim 1, wherein the identification information is defined by an output from a process development tool.

7. The computer implemented method of claim 1, wherein the identification information is a tuple.

8. The computer implemented method of claim 7, wherein the tuple comprises an identifier of the business process, an identifier of the staff activity in the business process, and business objects affected by actions of the staff activity.

9. The computer implemented method of claim 1, wherein an authorization policy engine in the access control system receives the identification information from the process server.

10. A data processing system for dynamically assigning a staff activity to a human entity or organizational role, the data processing system comprising:

a bus;

a storage device connected to the bus, wherein the storage device contains computer usable code;

at least one managed device connected to the bus;

a communications unit connected to the bus; and

a processing unit connected to the bus, wherein the processing unit executes the computer usable code to receive, from a process server, identification information about a staff activity in a business process at an access control system external to the process server;

resolve the staff activity at the access control system at runtime by assigning the staff activity to a user based on an access policy of the access control system to form a staff activity assignment in response to initiation of the business process, and communicate the staff activity assignment from the access control system to the process server, wherein the computer usable code to receive, resolve, and communicate enable development of the business process to be decoupled from staff activity resolution at runtime.

11. The data processing system of claim 10, wherein the processing unit further executes the computer usable code to provide the staff activity assignment to the user.

12. A computer program product for dynamically assigning a staff activity to a human entity or organizational role, the computer program product comprising:

a computer usable medium having computer usable program code tangibly embodied thereon, the computer usable program code comprising;

computer usable program code for receiving, from a process server, identification information about a staff activity in a business process at an access control system external to the process server;

computer usable program code for resolving the staff activity at the access control system at runtime by assigning the staff activity to a user based on an access policy of the access control system to form a staff activity assignment in response to initiation of the business process; and

computer usable program code for communicating the staff activity assignment from the access control system to the process server;

wherein the computer usable program code for receiving, resolving, and communicating enable development of the business process to be decoupled from staff activity resolution at runtime.

13. The computer program product of claim 12, further comprising:

computer usable program code for providing the staff activity assignment to the user.

14. The computer program product of claim 12, wherein the staff activity assignment is provided to the user in response to the user logging onto the process server.

15. The computer program product of claim 12, wherein the computer usable program code for resolving the staff activity at the access control system further includes:

computer usable program code for examining membership of the user in an organizational group or role; and

computer usable program code for assigning the staff activity to the user based on the user'"'"'s membership.

16. The computer program product of claim 12, wherein the user is one of a human entity, organizational group, or organizational role.

17. The computer program product of claim 12, wherein the identification information is defined by an output from a process development tool.

18. The computer program product of claim 12, wherein the identification information is a tuple.

19. The computer program product of claim 18, wherein the tuple comprises an identifier of the business process, an identifier of the staff activity in the business process, and business objects affected by actions of the staff activity.

20. The computer program product of claim 12, wherein an authorization policy engine in the access control system receives the identification information from the process server.