Embedding ‘Break the Glass’ into Business Process Models

Abstract

Abstract. Break the Glass (BTG) is an important feature for authorization infrastructures, as it provides flexible access control in unforeseen cases and emergencies. But current realizations have two drawbacks: (1) they neglect the need to manage authorization steps and (2) they do not take immediate process context into account. Our approach in turn embedds BTG functionality into business processes (BPs): the steps to decide for Breaking the Glass and the obligations compensating a BTG access for data are parts of the BPs. To support process designers in embedding BTG steps and obligations, we introduce an expressive annotation language for specifying BTG tasks for BP models. In particular, our language allows process designers to (1) take BP context into account, and (2) specify security constraints for responsible role holders performing BTG tasks. Using our approach, one can efficiently specify and use context-aware BTG functionality for BPs.