A Secure Workflow for E-Government Application - Essay Example

Abstract-- In any organization, the management information system (MIS) is not only a computer-based human-machine system that can support and help the administrative supervisor, but also an open technology system for society. It should provide the interaction functions that face the organization and environment, and gather, transmit and save the information [1]. This paper explains how to improve the efficiency of workflow management systems used in e-government portals. These management systems will help businesses find ways to improve their production or service process by using new technology called onion routing to ensure secure transmitting and protect the security and privacy of user information. Keywords: MIS, E-Government, Secure Workflow management System, Onion Routing. I. INTRODUCTION Governmental agencies are providing services to their citizens and Foreign Companies via dedicated web sites. Foreign users require services from the local department such as renewals of licenses and purchasing tenders. Providing a single secure portal that acts as a window to the various services is beneficial not only to these government agencies, but also to their foreign customers. To get the full advantage of a workflow management system governmental agencies need a customized solution that fully corresponds to business and industry specifics. That is, a scalable platform for different tasks: Data Flow Management Task Scheduling Project Management Document Exchange Secure Communication Integration with Legacy Systems This paper present an approach for designing a secure workflow management system for e-Government portal, In section 2, we discuss some studies which are related to my research .In section 3, we briefly describe the overview of WFMS .The tools that will be used to improve the efficiency of workflow management systems in e-government portals and the advantages of utilizing these secure portals is presented in section 4. The onion routing technique is displayed in section 5and the methodology is discussed in section 6. Section 7&8 present the solution architecture and solution security, availability and scalability. We end this paper with section 9 that include future work and conclusion. II. Related work Vijay Atluri from Rutgers University have claimed that Most of commercial workflow systems provide minimal security features such as user authentication, Although some commercial WFMSs such as Flow Mark, Lotus Notes and Chan engine can support role-based access control, they do not provide support to specify and enforce separation of duties constraints. They have to be implemented in an ad- hoc manner through a script type language [3]. Such ad-hoc implementation makes specification, analysis and maintenance of security policies more difficult. Also he declared that many efforts in WFMS implementation have been placed in protecting data transmitted over the network, but little emphasis has been given on providing access control for workflow activities. He mentioned the security requirements of workflow systems and discusses authorization, separation of duties, authentication and anonymity at length. One of the most basic component in e-government is Document management , regarding to this point of view, Kunis, R. Rünger, G. and Schwind M., they talk about importance of Document management in e-government for reaching the goal of paperless offices also he introduce a model of hierarchical process folders which is tailored to the execution of government processes and finally he discuss the security levels which provides security mechanisms that are tailored to the processing of distributed government processes within and between authorities[9]. III. WORK FLOW MANAGMENT SYSTEM E-government web application systems for governmental agencies need to support many different missions through cooperation with different organizations and allies. In today’s fast paced and dynamic environment, it is almost impossible to design and implement a different information system for each mission. Therefore, they require workflow management systems (WFMS) to enable globally distributed users and existing applications to cooperate across classification domains to achieve mission critical goals. A WFMS that allows users to program multilevel mission logic, securely coordinate widely distributed tasks, and monitor the progress of the workflow across classification domains is necessary. These paper present requirements for e-government portal workflow and strategy for implementing it. It also describes the need for a secure portal and the challenges and possible solutions to creating secure e-Government portals for global citizens and companies using electronic signature technology and onion routing. Workflow is a concept closely related to reengineering and automating business and information processes. A workflow may describe business process tasks at a conceptual level necessary for understanding, evaluating, and redesigning the business process. On the other hand, workflows may capture information process tasks at a level that describes the process requirements for information system functionality and human skills. The distinction between these workflow perspectives is not always made, and sometimes the term workflow is used to describe both of the business and information systems perspectives [10]. Workflow management systems (WFMSs) provide the ability to specify, execute, report on, and dynamically control workflows involving multiple humans and HAD systems. It is a technology supporting the reengineering of business and information processes. It involves defining workflows; that is, describing those aspects of a process that are relevant to controlling and coordinating the execution of its tasks (and possibly the skills of individuals or information systems required to perform each task). It also provides for the fast (re)design and (re)implementation of the processes that businesses need, and information systems change, to effectively support WFM. Workflow management systems allow organizations to define and control the various activities associated with a business process. In addition, many management systems allow businesses the opportunity to measure and analyze the execution of the process so that they can make continuous improvements. Such improvements may be short-term (e.g., reallocation of tasks to better balance the workload at any point in time) or long-term (e.g., redefining portions of the workflow process to avoid bottlenecks in the future). Most workflow systems also integrate with other systems used by the organization: document management systems, databases, e-mail, office automation products, Geographic Information Systems (GIS), production applications, etc. This integration provides structure to a process that employs a number of otherwise independent systems. It can also provide a method (such as a project folder) for organizing documents from diverse sources [9, 10]. Some typical features associated with many Workflow Management Systems [12, 13]: Process Definition Tool: A graphical or textual tool for defining the business process. Each activity within the process is associated with a person or a computer application. Rules are created to determine how the activities progress across the workflow and which controls are in place to govern each activity. Some workflow systems allow dynamic changes to the business process by selected people with administrative clearance. Simulation, Prototyping and Piloting: Some systems allow workflow simulation or create prototype and/or pilot versions of a particular workflow so that it can be tried and tested on a limited basis before it goes into production. Task Initiation and Control: The business process defined above is initiated and the appropriate human and IT resources are scheduled and/or engaged to complete each activity as the process progresses. Rules Based Decision Making: Rules are created for each step to determine how workflow-related data is to be processed, routed, tracked, and controlled. As an example, one rule might generate email notifications when a condition has been met. Another rule might implement conditional routing of documents and tasks based on the content of fields. Still another might invoke a particular application to view data. Document Routing: In simple systems, this might be accomplished by passing a file or folder from one recipient to another (e.g., an email attachment). In more sophisticated systems, it would be accomplished by checking the documents in an out of a central repository. Both systems might allow for redlining of the documents so that each person in the process can add their own comments without affecting the original document. Invocation of Applications to View and Manipulate Data: Word-processors, spreadsheets, GIS systems, production applications, etc. can be invoked to allow workers to create, update, and view data and documents. Work lists: These allow each worker to quickly identify their current tasks along with such things as due date, goal date, priority, etc. In some systems, anticipated workload can be displayed as well. These systems analyze where jobs are in the workflow and how long each step should take, and then estimate when various tasks will reach an individual’s desk. Task Automation: Computerized tasks can be automatically invoked. This might include such things as letter writing, email notices, or execution of production applications. Task automation often requires customization of the basic workflow product. Event Notification: Staff and/or managers can be notified when certain milestones occur, when workload increases, etc. Distribution (Routing) Lists for Messages/Mail: Distribution lists can be created for sending ad-hoc messages among the staff. Process Monitoring: The system can provide valuable information on current workload, future workload, bottlenecks (current or potential), turn-around time, missed deadlines, etc. Access to Information over the World Wide Web: Some systems provide Web interfacing modules in order to provide workflow information to remote customers, suppliers, collaborators, or staff. Tracking and Logging of Activities: Information about each step can be logged. Administration and Security: A number of functions are usually provided to identify the participants and their respective privileges as well as to administer routines associated with any application (e.g., file back-ups, archiving of logs). Rule-based generation of customized workflow definition given User Profile, Services, Business Rules, Compact representation of workflow and Easy to design Lead to faster reaction to customer demands and timely reaction to changing tasks/services or participating agencies. The Secure Workflow Management System (SWMS) software will be able to help managers and staff achieve secure workflow e-government portal by having functionality such as: Operations can be assigned by department and section, operation or steps within an operation’s access can be limited to employees of a certain department and section. Operations can be assigned to employees with a certain level or job description such as department manager or employee. These are facilities that can be used by the flow definition as the business process requires. Access control is normally linked to the employee login screen. As he logs in to the system, all security privileges are set and the appropriate menu access privileges are displayed. Easy to use facility for setting the Process Flow. As most of transaction requires Work Flow, it is very critical to provide a service to easily define the Flow. Some of the main features of this Work Flow definition service are: Actions required are user defined with the ability of defining system behavior for each action. The three main actions are approve, reject, and notification. System Flow integrates with job hierarchy and position hierarchy (i.e. Flows can be assigned directly to a direct manager or a certain department manager…). This can be done going up and down, as well in the hierarchy. System Flow can also be set to target a certain position or a certain person. Notification services are done automatically in services such as a transaction or a request originator. In other cases within the flow definition, it can be set to notification, to be sent at a completion of a step, the whole process, or on a certain action in the flow. A very important feature is the authorization during absence feature. The system enables the user or the Administrator to authorize others during the absence of the employee. This is accomplished by giving the present employee access to the absent employee’s mail. The system also registers all approvals made under the authorization and notifies the original employee of all transactions done on his behalf. IV. E-GOVERMENT PORTAL Portals act as a one stop resource for information. Having a secure e-Government Portal will reduce the costs for the government in delivering timely information to its citizens. The citizens will also benefit from timely and readily available information as well as a medium to avail services. Having a web portal will reduce the need for dedicated governmental representatives to be available by other modes of communication such as phone or email to provide information to citizens. It will be more simple and cost effective for governmental representatives as well as governmental legislative bodies such as the Senate and the House of Representatives to get in touch with the citizens and pass information on important legislation and citizen action items [8,9]. Opportunities for Organizational Change: Workflow Management Systems can help agencies and departments achieve the organizational changes necessary to operate effectively in today’s world. These changes might include the move to flatten organization structure and develop greater team orientation. Since activity steps, roles, and rules are built into the system, less intervention will be needed to manage the business process. In addition, improved communications provided by notifications, document sharing, and an improved understanding of the process itself can lead to increased collaboration among team members and/or across teams and business units. Workflow management systems tend to unify people with diverse skills into a more cohesive unit [12]. Opportunities for Process Change: Since workflow systems force organizations to examine and define their business processes, it is the ideal time to consider business process reengineering. In fact, it is essential that an underlying process be analyzed and improved prior to workflow system implementation in order to avoid further embedding of bad practices. James Kobielus suggests that an organization optimize a process with any of three goals in mind: “minimizing process time, maximizing value-added process content, or maximizing flexibility at the initial point of customer contact” [4]. He provides some guidelines for achieving each of these: To minimize process time reduce the number of participants in a process reduce the maximum completion time of each task (automate tasks, notify staff of approaching due dates) reduce time to transfer work between tasks reduce maximum queuing time for any one project (prioritize items that have been awaiting action for a long time) increase the number of tasks running in parallel To maximize value added content (i.e. improve the quality of your product or reduce its price) apply standard workflow routes, roles, and rules automatically to each new case; deviate from the standard only when certain predefined thresholds are crossed (exceeds dollar limit) or certain flags are raised (customer complaint) provide participants with immediate, on-line access to all information bases enable continual tracking and notification eliminate costs associated with paper documentation (scan and index as soon as it enters the workflow) To maximize flexibility (i.e. more fully address customer needs) at the initial point of contact provide multiple access options capture customer data only once support distributed transaction processing (“one-stop-shopping” for multiple transactions) enable ad-hoc flexible work-flow by allowing the first point of contact with the customer to tailor the process to the customer’s needs Just as important as reengineering is workflow management’s support for continuous business process improvement. Systems which log information about how the defined process is actually working in practice provide valuable insights into areas that might be better tuned. Since business people can define workflow without IT involvement, there is more likelihood that process changes will occur. Improved/Increased Access to Information: Workflow management systems build corporate knowledge. “Workflow takes the business intelligence that comes from experience and embeds it ...” [5] Process information that may have been scattered among various staff members is now combined and available to all employees. This is especially useful to newer employees who may have limited understanding of a more complex business operation. “Workflow environments encourage knowledge workers to add greater structure - in the form of routing lists, receipt notifications, version controls, (and procedures)...” [6] Staff is now more likely to provide information to other members of the team. For any particular project or job, more information about both the history and the current status of the process is now available for any staff member to view. Improved Security and Reliability: Workflow management “provides secure storage and access to a consistent set of all of the data related to a service.”[7] Workflow management unites data from many different applications and provides this data with organization and integrity. Using mechanisms such as role privileges (determines who can access and/or change information), process control (e.g. a document may need management approval before moving on to the next step), version control, and system back-ups, the data becomes more reliable. V. ONION ROTURING The onion routing technique seen in Fig. 4 is used for anonymous communication over a computer network. Messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, and sends the message to the next router where this is repeated. This prevents these intermediary nodes from knowing the origin, destination, and contents of the message. Onion Routing for Anonymous and Private Internet Connections, Preserving privacy means not only hiding the content of messages, but also hiding who is talking to who (traffic analysis). Much like a physical envelope, the simple application of cryptography within a packet-switched network hides the messages being sent, but can reveal who is talking to whom, and how often. Onion Routing is a general purpose infrastructure for private communication over a public network. It provides anonymous connections that are strongly resistant to both eavesdropping and traffic analysis. The connections are bidirectional, near real-time, and can be used for both connection-based and connectionless traffic. Onion Routing interfaces with off the shelf software and systems through specialized proxies, making it easy to integrate into existing systems [11, 14, 15]. Fig.1. Onion Routing Technique VI. The proposed System design The proposed system used a methodology to develop the Secure Workflow management system (SWMS) for e-government portal, the following steps are performed: 1. Study system requirements and figure-out the type of processes needed. 2. Study important functionality that will be used to enrich both the Work flow and system security. 3. Study onion routing and PKI Capabilities. 4. Develop secure workflow management system using onion routing. 5. Test the new SWM system 6. Implement the SWM system 7. Compare the difference of using onion routing technique in the system compared to the usage of same system without it. After studying Fig. 1 General Structure for Management Information and Fig. 2 General Structure of Web based Solution .We designed the following solution architecture This is shown in Fig.3. Fig. 3. General Structure of Web based solution of the Proposed Model. The proposed architecture contains the following component: - Oracle10g Database (S1) This server will contain Oracle10g Database installed with shared disk storage or storage network like SAN. The Node will have 2 Processors and 4 GB Memory. This server wills contain Intranet applications data and Workflow engine. -Application Server (S2) On This server we will install and configure an instance of Oracle10g Application Server configuring Oracle forms, Portal (if required) and Single Sign On. The servers S2 will have 2 processors and 4 GB of memory. -The solution software elements are: Oracle Application Server Enterprise Edition. Oracle Database Enterprise Edition. Oracle Workflow Optional Database RAC Linux Advanced Redhad as operating system Fig.2. General Structure for Web Based solution Fig.4. the proposed architecture VII. SOLUTION SECURITY, SCALABILITY & AVAILABILITY A. Security Information Systems security deals with the issues of safeguarding the system from disasters, failures and possible errors. A failure of such a system or a breach of security can affect us in many ways, personally, socially, or financially. A threat may be caused in a variety of different ways. These ways can be classified into three broad categories: Accidental or unintentional errors, The accumulated unintentional security damage can far exceed the cost of computer crime. Hardware components such as memory, network connections, network cabling, network servers, may accidentally fail causing a security breach. One of the most common threats is ordinary carelessness or poor employee training. Intentional errors Organizations suffer from intentional security violations from their own employees more than from outsiders. Having an in-depth knowledge of the organizational Information Systems is one of the main reasons for this. Destruction of the system, a part of the system, or the supporting IT and the communication system may occur due to a natural disaster such as fire, lightening, flood, hurricanes, earthquakes, and tornadoes. 1) Security Schema: As clearly transparent threats to system are variables and security consideration should counter attack each one to ensure proper operation. These considerations will be supported through the proper design, secured connections and the use of onion routing. The security model will be based on 5 levels as follows: Originally developed by the U.S. Navy, Onion Routing is a technique to hide the true origin of packets on an IP network. In onion routing, packets are sent through a network of randomly selected proxy servers before being delivered to their final form. B. Scalability & Availability The Core Technologies of Oracle Suite that ensure Scalability & Availability 1) Cluster definition: There will be a discussion of the details concerning how to scale the solution. Cluster Definition: Table.1.Levels of Security Clustering makes several independent systems appear like one. Together, the clustered system is more scalable than an individual system. The clustered system masks the failure of a member – and hence is more available. Fig. 5. Application Server Clusters The Core Technologies of Oracle Application Server Clusters are the following Components: Oracle Web Cache This is typically the first component of Oracle to receive the request. For both static and dynamic requests, it can cache the result and then replay the results, thus reducing the workload of the machines behind. In addition, these Web Cache instances can themselves be clustered. Oracle HTTP Server (OHS) This is the next in line after Web Cache to receive a request, OHS is based on Open Source well proven Apache Web Server (www.apache.org) Oracle Containers for J2EE (OC4J) This is the J2EE 1.3 compliant container in Oracle. It provides clustering capabilities for the J2EE components – Servlets, JSP, and EJB. The OC4J is where the application components resides These Components represent the different Tiers the N-Tier application consists of, these tiers can be physically separated on different Server nodes. Each tier has its own Clustering specifications & characteristics. 2) Availability Concepts: Availability involves providing failover mechanisms to overcome system failures without stopping the application. 3) Scalability Concepts: Scalability is the capability of the platform to adopt new Hardware resources as the provided services traffic & usage increases. 4) Oracle Web Cache Clustering: Web Cache component provides a way to cache both static and dynamic requests and thus provides performance boost by reducing the need to go to the back end server (cache hits). Since fewer requests go to the back-end application server, it also results in better scaling of the back-end systems. In a cache cluster, multiple instances of Oracle Web Cache operate as one logical cache. Each cluster member can propagate object changes – including invalidations, destroys, and replaces – through the cluster’s messaging system to other caches in the cluster. This allows for the content to stay synchronized, without the overhead of centralized control. As the figure shows, the cluster members communicate with one another as well as with the application Web servers and with the client. Fig. 6. Overview of Cache Clusters Also Oracle HTTP Server (powered by Apache) has the following Characteristics: Transparent Failover: The failure of the web server is handled by an external component – a Web Cache or an external load balancer. These devices typically ping a back-end OHS and make sure that the server is up. If they find it to be down, they take it out of their routing table, and then add it back when it returns to service. The clustering framework (specifically, the OPMN component discussed earlier) constantly pings the OHS process and ensures they are up. If it detects a failure, it will ensure that all children are cleanly shutdown and then restart the parent OHS process. VIII. CONCLUSION AND FUTRE WORK The designed solutions will help governmental agencies take full advantage of web-enabled workflow automation systems through advanced information exchange, streamlined collaboration, shortened operation cycles and reduced costs. Our workflow management system adds real business value and ensures higher productivity and accountability allowing agencies to: Automate information secure flow processes Release resources from repetitive operational tasks Optimize project management Improve project team collaboration and productivity Speed up decision-making Improve information availability Save time and costs For improving the delivery of governmental services to citizens, non-citizen residents and commercial vendors, future work should involve periodic, regular surveys, both online and mailed, to all stakeholders of the e-government initiatives to ensure that these systems are accomplishing what they are intended to accomplish and are providing the range of services desired by their users. Our next approaches to be concluded in the following: 1. Design and implement one of e-government service as a multi level secure workflow system. 2. Add more functionality to the web site such as search engine, application forms for career opportunities, visiting application for agent's member and questionnaires. 3. Improved SWMS e-government web application to be a custom Web-based solution that automate processes and unify business resources. This enables business to handle more volume, and use information and resources more effectively. REFERENCES 1. Duan, R., Zhang, M., 2007, in IFIP International Federation for Information Processing, Volume 252, Integration and Innovation Orient to E-Society Volume 2, eds. Wang, W., (Boston: Springer), pp. 218-226. 2. ACM, V. Atluri, S. Chun, and P. Mazzoleni, “A Chinese Wall Security Model for Decentralized, Workflow Systems,” submitted for publication, 2001. 3. V. Atluri and W-K. Huang, ``An Authorization Model for Workflows,'' Proceedings of the Fifth European Symposium on Research in Computer Security, Rome, Italy, and Lecture Notes in Computer Science, No.1146, Springer-Verlag, September, 1996, pages 44-64. 4. Grohe, A. (2002). Transforming Data Into Information. http://datawarehouse.ittoolbox.com/documents/document.asp?i=1143 5. Griffin, Jane (1998) DM Review. Information Strategy: Data Mart vs. Data Warehouse a. http://www.dmreview.com/editorial/dmreview/print_action.cfm?articleId=815 6. Len Wyatt (2003) Microsoft Corporation, Business Intelligence at Expedia: A Technical Case Study. 7. Inmon, B. (1999). DM Review. Data Mart Does Not Equal Data Warehouse. http://www.dmreview.com/article_sub.cfm?articleID=1675 8. Kunis, R. Rünger, G. and Schwind M. (2007) “A Model for Document Management in e- Government Systems Based on Hierarchical Process Folders” The Electronic Journal of e-Government, 5(2): 191 – 204. 9. Knaack, I. & Göttsche, H-P. (2004). Work flow management systems as the basic technology for e-Government. Bonn, Germany: Federal Office for Information Security (BSI). 10. Krishnakumar, N., Sheth, A.: Managing Heterogeneous Multi-system Tasks to Support Enterprise-wide Operations. Distributed and Parallel Database Journal, 3 (2) (April 1995) 11. Kunis, R. Rünger, G. and Schwind M. (2007) “A Model for Document Management in e- Government Systems Based on Hierarchical Process Folders” The Electronic Journal of e-Government, 5(2): 191 – 204. 12. METEOR project home page. http://lsdis.cs.uga.edu/proj/meteor/meteor.html 13. Kang, M., Froscher, J., Eppinger, B.: Towards an Infrastructure for MLS Distributed Computing. 14th Annual Computer Security Applications Conference, Scottsdale, AZ (1998) 14. Miller, J., Palaniswani, D., Sheth, A., Kochut, K., Singh, H.: WebWork: METEOR’s Web-based Workflow Management System. Journal of Intelligent Information Systems, Vol 10 (2) (March/April 1998) 15. Forte, D. (2006). Advances in onion routing: Description and back tracing /investigation problems. Digital Investigation 3: 85-88. Read More