Access Control in <scp>BPMSs</scp>: A Case Study for Building a Privacy‐Preserving <scp>COVID</scp>‐19 Process in Bonita

Abstract

ABSTRACT Currently controlling access to patients' medical information in e‐health applications is a growing challenge. It is identified as a critical security requirement, specifically within the business process management (BPM) approach, which allows the modeling, implementation, and continuous improvement of processes. This approach facilitates the management of processes through the use of business process management systems (BPMS), which enable their execution. However, existing BPMSs, such as Bonita, offer limited native access control mechanisms. They rely on static actor filters for task assignments, which lack flexibility and require manual adjustments when user roles change. Additionally, implementing custom filters in Bonita often demands complex programming, such as Java coding or integrating external services like REST APIs, to dynamically manage roles and permissions lists. This research aims to address this gap by integrating a more robust access control filter into BPMSs, specifically Bonita. Our proposed solution focuses on providing role‐based task management while ensuring data privacy in sensitive processes. A validation of the solution was conducted on a case study related to the COVID‐19 healthcare process at a Tunisian hospital. The solution, implemented in Bonita, allowed authorized actors to access and perform tasks based on their roles. This demonstrated its effectiveness in securing workflows, protecting patient data, and overcoming traditional BPMS access control limitations.