Secure workflow management system for Kuwait Ministry of Defense e-tendering

Building a Secure Workflow Management System (SWMS)

for e-Government Web Applications

Supervisor:

The Kuwait Ministry of Defense (MOD) needs secure workflow management systems (SWMS) to enable globally distributed users and applications to cooperate across classification levels to achieve critical goals, an SWMS that is dedicated to improve tender processes through the internet, it considered as an online tender management system that permits administrators to automatically issue military electronic tenders to a list of tendering companies. To this end, this study presents a roadmap for implementing (SWMS) e-tender application for (MOD) and focuses on onion routing technique for anonymous communication over a computer for such workflows.

Building a Secure Workflow Management System (SWMS) for e-Government Web Applications

Introduction

Background.

A Web application is simply an application that is accessed via Web browser over a network such as the Internet or an intranet. It is also a computer software application that is coded in a browser-supported language (such as HTML, JavaScript, AJAX, Java, etc.) and reliant on a common Web browser to render the application executable. Web applications have become increasingly popular in recent years due in large part to the ubiquity of a client, sometimes called a thin client. The ability to update and maintain Web applications without distributing and installing software on potentially thousands of client computers is a key reason for their popularity. Common Web applications include Web mail, online retail sales, online auctions, wikis, discussion boards, and many others.

Online Tender integrates online collaborative technologies with procurement automation to enable purchasing teams to compile detailed tender documents and simultaneously invite tender submissions online, by a specified close date. For the first time suppliers' tenders are published as sealed bids, into an online safe deposit box. They can only be opened by specified representatives on the pre-determined tender opening date. Moreover, such user friendly systems ensure that even suppliers with no knowledge of online tendering systems can respond easily. Online tender techniques also reduce tender periods to days rather than weeks, providing significant improvements to current non-automated working practices. Indeed, more streamlined tender approaches are revolutionizing procurement and are well poised to provide the MOD Web site with an improved ability to process tenders in an electronic way by accepting offers from foreign companies, acknowledging their receipt and automating their processing among the internal agencies responsible for their administration. The design and implementation of an MOD Web application also provides an effective and fast way of communication which allows the authorized persons to interact with foreign companies around the world. These are particularly important benefits because there are already currently 107 open foreign military sales (FMS) contracts between the U.S. military alone and the Kuwait Ministry of Defense totaling $8.4 billion (Kuwait, 2009).

According to Sabinet's (2009) definition, "Workflow environments encourage knowledge workers to add greater structure - in the form of routing lists, receipt notifications, version controls, and procedures" (p. 1). In this setting, staff are now more likely to provide information to other members of the team. For any particular project or job, more information about both the history and the current status of the process is now available for any staff member to view also it "provides secure storage and access to a consistent set of all of the data related to a service" (Government online, 2009, p. 1). Workflow management systems also serve to unite data from many different applications and provides this data with organization and integrity. Using mechanisms such as role privileges (determines who can access and/or change information), process control (e.g., a document may need management approval before moving on to the next step), version control, and system back-ups, the data becomes more reliable. Therefore, having a secure e-Government web application will reduce the costs for the government in delivering timely information. Having a web application will reduce the need for dedicated governmental representatives to be available by other modes of communication like phone or email to provide information to others.

1.2.

Proposal, Software and Hardware Specification

Despite recent initiatives to bring the process in line with various e-government initiatives, the Kuwait MOD continues to experience a major problem with tender offers for goods and services. Currently, these tenders are posted by the Central Tenders Committee and are administered by the Foreign Procurement Department (FPD). The FPD provides the MOD with all requirements such as military devices, equipments, software and so forth only from outside Kuwait. The cycle of tender requires a long time to reach final state an estimated time between 6 to 8 months which constraints the performance of work.

There are currently a number of opportunities for miscommunication between the foreign procurement department and foreign companies to occur when the e-government techniques being implemented are applied, and although some notification should be sent as soon as possible to companies that participate in the tender, the process remains labor intensive and largely manual and notification by normal mailing is slow. In addition, there are a number of considerations involved in the implementation and design of e-government initiatives because unauthorized users will inevitably attempt to access the MOD computer system which carries the potential for doing a great deal of damage to the system itself as well as gaining access to sensitive information. For this reason, Onion Routing will be used to prevent unauthorized access. With this approach, the message for each execution is encrypted with the private key.

Taken together, the advantages of e-government carry a number of obstacles that must be successfully addressed to gain the maximum advantage from these worthy initiatives and the purpose of this study was therefore to build an Internet- and intranet-accessible Web-based application that could resolve these problems while maximizing the utility of the existing components of the e-government technologies in place. Other governmental entities have used this approach to good effect in recent years as well. For example, Hotte and Kingman (2002) report that some of the advantages of this approach to workflow management include, "Information will be efficiently used from one logical source using a standard easy-to-use Web interface. Employees who are geographically dispersed throughout the state can work on common tasks. Travel will be reduced, thus increasing productivity" (p. 64). The provision of intranet access will also decrease the time MOD employees will have to devote to routine communication and administrative tasks. The Web-based technology has offered a new approach for delivering data by supporting distributed information authoring, publishing and management. Information is authored and managed by those who create it (Hotte & Kingman, 2002). The solving approach concentrate on create a Web page for the MOD that is linked with database to store tenders data and offer them in the internet and company can access the site and register in it. The data of registered company sent to MOD and approved using e-signature technique then the company receive qualification number which help to participate in any existing or future tender offered by the MOD. The application will also use Onion Routing for Anonymous and Private Internet Connections in order to ensure secure complete electronic tender life cycle.

1.2.

Overview of the Study

The study is comprised of five main chapters as follows. Chapter one provides an introduction to the study and a summary of its purpose and scope. The second chapter provides a review of e-government in general and e-government principles, tools and the framework used to implement this initiative at the Kuwaiti MOD. Chapter three presents the theoretical foundation of the study including its methodology and the security considerations that must be addressed in the Web-based application. Chapter four provides a description of the design and implementation of the application followed by chapter five which provides an analysis, conclusion, summary of lessons gained and directions for future work.

The main tasks of the study were to design and built a Web page represent an effective and fast way of communication allows the authorized persons to interact with foreign companies around the world which will be consider as an important step for processing of e-Government, These tasks will lead us to solve the main problem which summarized in that there are very long time consumed during execution the tender process between F.P departments and foreign companies also our model will ensure (security -- reliability-performance) for MOD web application.

1.3.

Scope of Work

1.3.1.

e-Government. SWM e-tender application is considered an important step for processing of e-Government and a best solution of the problem of time wasting from manual foreign procurement tenders between MOD in Kuwait and foreign companies that ensure successful outcomes. EFP Tenders introduced as web page can access directly from internet, and built by web technology called web application. This web application developed by java technology as JSP and Servlet and data stored in database called Oracle data base. The web site published in web server called application server, Onion routing is a technique that will be used for anonymous communication over a computer network. Messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, and sends the message to the next router where this is repeated. This prevents these intermediary nodes from knowing the origin, destination, and contents of the message.

1.4.

Lecture Survey.

The predicted solution of the problems related to e-government administration depends on answering the following questions as brainstorming ideas to solve the problem and the features provided by the system or application.

1. An important step for processing of e-Government.

2. To ensure the confidentiality of information such as contracts for military weapons and other by Providing a high level of security as it is based on singing the data by combining multiple key values like user id, date stamp and transaction id which produce an encrypted key utilized and used only internally by the system for authentication and validation of user privileges. This procedure would make it virtually impossible to falsify any part of a transaction approval.

3. Save time - have all tender and information available in one place.

4. More efficient searching - searching across the tender description as well as the categories.

5. Reliable and trusted information - comprehensive source list and category list available.

6. Easy user-friendly access - no additional software is required to access the information. (Browser printing, downloading and e-mail options are available for the full-text.)

7. Daily updates, and maintained day by day.

8. By using electronic signature of the data which is performed internally on behave of the user for all transactions to provide more security and confidentiality of the data in order to prevent illegal tampering with the data and to detect when it is occurred.

1.5.

Objectives of Study

The primary objective of the study was to produce tangible physical output from a Web application that can be deployed in any web server. Upon completion of the study, the following outcomes were provided:

1. JSP files which represent the Web page interfaces;

2. Servlet as java classes which contain the business logic and interaction with data base;

3. Database tables which contain all stored data; and,

4. Documentation which describes the code.

2.0. Chapter 2: Review of the Relevant Literature

2.1.

Chapter Introduction

This chapter presents an overview of Kuwait and its major trading partners to establish potential cross-cultural issues that may become involved in the launch of the WMS Intranet for tender offers described in the introductory chapter. A discussion concerning e-government principles, tools and the framework in which these initiatives have been implemented in Kuwait is followed by a description of management system, including work flow management systems, relevant WFMS principles, tools and a corresponding WFMS framework used to implemented its internal use in the Kuwait MOD.

2.1.1. Kuwait Overview. Today, Kuwait has a small but relatively open economy that is heavily impacted by the oil industry and government sector. In fact, about nine out of ten members of Kuwait's civilian workforce are employed in the public sector, and a comparable percentage of private sector workers are non-Kuwaitis (Kuwait, 2009). The dominance of the oil industry is not surprising given that Kuwait's proven crude oil reserves of about 100 billion barrels account for almost 10% of the proven world reserves and represent almost half (45%) of the country GDP and almost all (95%) of its export revenues; it addition, the Kuwaiti government is almost wholly funded (between 90%-95%) by oil revenues (Kuwait, 2009). The government is not short-sighted concerning its oil resources, though, and allocates 10% of its oil revenues each year to a trust fund designated the, "Fund for Future Generations" preparatory to the inevitable transition to the country's needs following the exhaustion of its oil reserves (Kuwait, 2009). The Kuwaiti economy has experienced healthy growth in recent years due to high prices for oil, which together with the economic activity created by Operation Iraqi Freedom (Kuwait is a major logistical and transit hub for Coalition operations in Iraq), have resulted in a period of economic prosperity that is unprecedented in the country's history (Kuwait, 2009). According to U.S. government analysts, "Non-oil sectors such as banking, financial services, logistics, telecommunications, and construction have enjoyed strong growth in the past three to four years. The global financial crisis affected Kuwait in late 2008, with the Kuwait Stock Exchange -- the region's second-largest bourse -- losing almost 40% of its market capitalization during 2008" (Kuwait, 2009, p. 3). Kuwait has also experienced significant budget surpluses in recent years as a direct result of sustained high oil prices (Kuwait, 2009).

2.1.2. Kuwait Trading Partners. Currently, Kuwait's primary export partners are Japan, South Korea, the United States, Singapore, China and the Netherlands; the country's primary important partners are the United States; Japan, Germany, China, Saudi Arabia, South Korea, Italy, India and the United Kingdom (Kuwait economy, 2009). The respective levels of trade with these export and import partners are shown in Figures 1 and 2 below

Figure 1. Export Partners' Percentage of Trade (2008 est.).

Source: Based on data in Kuwait economy, 2009 at https://www.cia.gov/library/publications / the-world-factbook/geos/ku.html

Figure 2. Import Partners' Percentage of Trade (2008 est.).

Source: Based on data in Kuwait economy, 2009 at https://www.cia.gov/library/publications / the-world-factbook/geos/ku.html

The importance of the Kuwait Ministry of Defense has become increasingly apparent in recent years. For example, on August 2, 1990, more than 100,000 Iraqi soldiers invaded Kuwait at which time Saddam Hussein stated categorically that he regarded Kuwait as being Iraq's nineteenth province, an invasion that was subsequently characterized as being "absolutely unacceptable" by British Prime Minister Margaret Thatcher and as a "naked act of aggression" by then-U.S. President George H.W. Bush (Cuervo, 2008). As a result, the price of oil increased significantly and on the same date, the UN Security Council voted unanimously to condemn the invasion of Kuwait by Iraq as a violation of international law (Cuervo, 2008). Prior to the Gulf War that resulted from this invasion, Kuwait's armed forces were relatively small, being comprised of various army, navy, and air force units with most of the materiel being provided by the United Kingdom; however, the vast majority of this military equipment was destroyed by the Iraqis or confiscated during their retreat (Cuervo, 2008). As a result, the Kuwaiti military forces have been beefed up and provisions for resupply and rearmament have been underway since that time with materiel being provided by other governments as well, now, including vendors from the United States (Kuwait, 2009). Indeed, since the end of the First Persian Gulf War, the United States has delivered both military and defense technical assistance to Kuwait from foreign military sales (termed "FMS") as well as through a wide range of commercial sources (Kuwait, 2009). Moreover, there are currently more than one hundred open FMS contracts between the U.S. military and the Kuwait Ministry of Defense totaling $8.4 billion. Some of the primary U.S. military systems currently being acquired by the Kuwait Defense Forces include the Patriot Missile systems, F-18 Hornet fighters, the M1A2 main battle tank, AH-64D Apache helicopter, and a major revitalization of the Kuwaiti naval forces using U.S. boats (Kuwait, 2009).

2.2.

e-Government.

The term "electronic government" ("e-government") describes the use of electronic information and communications technology in order to integrate the customer into the activities of government and the public service. As the introduction of e-government continues apace, one focus has been on the optimization of administrative processes and structures using these technologies (Knaack & Gottsche, 2004). Kuwait is well situated to take advantage of e-government initiatives. According to Graafland-Essers and Ettedgui (2003), the presence of e-government is projected to increase in the years to come as online activities become more ubiquitous. These authors add that, "Generally, e-government designates any transaction that involves the government and that is carried out, even partially, using electronic means. E-government plays an important function in mediating government actions and its role will continue to grow as communications technologies become more widespread. Already, communications technologies change the way that government operates by facilitating information dissemination, communications and transactions" (Graafland-Essers & Ettedgui, 2003, p. 37).

2.2.1.

e-Government Principles. There is more involved in administering an e-government approach than merely transferring existing government operations to an online approach. In this regard, Graafland-Essers and Ettedgui emphasize that, "It calls for rethinking the way government functions are carried out today to improve some processes, to introduce new ones and to replace those that require it. The range of services that may be provided by e-government spans from simple information sites to fully interactive experiences where users and government engage in a dialog mediated by information technology" (2003, p. 37).

2.2.2.

e-Government Tools. Unlike many of its neighbors in the Middle East, Kuwait enjoys a well developed information technology infrastructure and a relatively high level of personal computer ownership among its citizenry. These aspects of Kuwaiti's information technology are consistent with the goals of 21st century e-government as well. According to Ayert (2005), "Knowledge age government operates in a world of flat politics, where the distance between rulers and ruled shrinks. Information technology puts the electronic mailbox of every government official within easy reach of every citizen's keyboard" (p. 76). Likewise, in a comprehensive e-government scenario, citizens can use the Web to obtain information about concerning employment opportunities, unclaimed property and consumer, health and safety tips, as well as track legislation. Making government services and information available on a round-the-clock basis is a real boon to the public. Citizens are not required to leave their homes or offices, fight traffic or stand in long lines; moreover, they are no longer restricted to conducting business only during normal office hours. The most important benefit to electronic government is that is opens the doors of government to every citizen, making it easier for people to obtain information and receive services (Bourquard, 2003, p. 24).

Although this level of e-government has not yet been fully realized in Kuwait, the country is well on its way to achieving this standard. In this regard, Hundley, Anderson, Bikson and Neu (2003) report that, "Kuwait wants what the information revolution offers, and wants it badly enough to be willing to risk some disbenefits that may arise from more open and possibly unacceptable communications. The wealthy country of Kuwait has a well-developed information infrastructure" (p. 115). There are other benefits for the government of Kuwait as well as its citizens and those who seek to conduct business with government agencies and ministries as well. For instance, Lim and Tang (2008) emphasize that, "E-government initiatives embracing new Web technologies as tools for public service delivery and citizen participation have become a key component of public sector reform worldwide. E-government initiatives, however, may have divergent impacts on environmental decision making, depending on the technological, social, and political conditions of the local community" (p. 109).

The information revolution future for Kuwait, though, promises to deliver continued improvements in government accessibility and the ease of doing business with government agencies and ministries in the future, and the government is expected to invest as much as it can in order to achieve the full benefits of it. The principal limiting factor will be money, but in many countries the Internet has proliferated widely enough to begin providing economic benefits significantly greater than the required investment. Private-sector investment will be the principal source of capital in most nations, although public-sector financing will remain important in Kuwait, for supporting the educational sector. Some driven nations will do better than others. Bahrain, Kuwait, and Qatar will continue to make the most progress toward information-centric futures as they seek to replace oil revenues that will decrease over time with other intangible products befitting their small size and lack of industrial base (Hundley et al., 2003). In addition, the it infrastructure in Kuwait has been projected as being fully capable of satisfying demand within the few years; however, the degree of Internet use will depend on the pricing policies of the public sector -- dominated Internet service providers (Hundley et al., 2003).

2.2.3

e-Government Framework that Implemented e-Government in Kuwait. The Kuwait government recently celebrated its one-year anniversary of implementing its e-government initiative and currently maintains a user-friendly Web site that features open tenders and guidance concerning how to do business with government entities including the various ministries. The Web site accessible at http://www.e.gov.kw / states that its online tender services allows the business sector to obtain tender, practice, or direct order documents from ministries concerning the general and specific terms and conditions, in addition to the item list or list of work and their annexes (book of conditions and technical specifications) (Tender practices, 2009).

The Central Tenders Committee, created in 1964 and attached to the Council of Ministers, specializes in receiving the tenders in accordance with the procedures specified by law and the law provides that it is not permissible for ministries and government bodies to import items or commission contractors to carry out works except public tender through the Central Tenders Committee (Central Tenders Committee, 2009). Indeed, it is this aspect of e-government that is widely regarded as being the most important for domestic and foreign companies seeking to do business with the Kuwaiti government's various agencies and ministries. A recent report from a UK analyst notes that, "For the business community the most significant element of e-government is business to administration (B2A). This is where public sector organisations at both a central and local level offer their services online. At present B2A is one of the least developed areas of e-commerce, yet it offers tremendous potential for growth as many traditional services could be delivered through the internet. It would for example be hugely convenient if business people could have access to standardized online planning application processes, regardless of which local authority they are based in" (Don't miss out on e-government, 2005, p. 6). This would also serve to reduce paperwork and the need to keep physically checking with planning departments, as progress could be reviewed online at any time (Don't miss out on e-government, 2006). Other ways of viewing e-government include government to citizen (GtC), government to business (GtB), and government to government (GtG) enterprises as shown in Figure 3 below.

Figure 3. Interactions between e-Government Stakeholders

Source: Graafland-Essers & Ettedgui, 2003, p. 5

It is in the government to business category, then, that the MOD tenders function would be categorized. Currently, the Central Tenders Committee posts current tenders available for its various agencies and ministries at http://www.ctc.gov.kw/, although this information is currently only available in the Arabic language. The Ministry of Defense also features a Management Information System division that is responsible for overseeing the provision and maintenance of all aspects of the administrative and financial services, and it has an effective role for the development, implementation and maintenance of the software requires by all divisions of the ministry (Kuwait Ministry of Defense, 2009). One major drawback to the current administrative system used by the Central Tenders Committee is a lack of provisions for filing the documents and forms needed to submit bids for government tenders and the process remains highly labor intensive involving a great deal of physical movement of people and documents. For example, hard copies of the following documents are still required to be filed with the Kuwaiti government:

1. Copy from the articles of incorporations;

2. Copy from the license issued from the Ministry of Commerce and Industry;

3. Registration certificate at Kuwait Chamber of Commerce and Industry;

4. Company or organization civil ID from the Public Authority for Civil Information;

5. Certificate of the national employment percentage; and,

6. Copy from the civil ID of the company agent to receive the documents (Tender practices, 2009).

The procedures involved in submitted bids for tender offers include the following steps:

1. Visit the Central Tender Committee and submit the required documents for tender offers; for practices, interested companies must visit the Tenders Section - Procurements and Stores Department of the Financial Affairs Body - First Floor - Ministry of Health Headquarters - Gamal Abd-El Nasser Street - Al-Sulaibikhat District and submit the required documents;

2. Complete the service application with the employee in charge; and,

3. Pay the fees due at the general cashier's counter of the Ministry of Health (Tender practices, 2009)

In spite of these laborious steps, the Kuwaiti government has made some major progress in its efforts to streamline its business practices using Web-based applications. For example, other recent initiatives by the Kuwaiti government to further its e-government initiative include the introduction of an automated system at every state agency responsible for issuing technical approvals for new utility connections. The total time required for obtaining the approvals for phone lines, electricity connections, water plans and from the sewage authority has fallen by 10 days. Also, the private credit bureau has added retailers to its information suppliers' database, causing the credit data index to increase by one point. In 2005/06, Kuwait sped property registration by hiring more staff at the registry while time to transfer real estate titles decreased from 75 to 55 days (Siddiqi, 2008, p. 34).

Based on these and other e-governmental initiatives, Kuwaiti has been ranked first among its neighboring countries in the Middle East and North Africa (MENA) in terms of accessibility and ease of doing business as shown in Table 1 and Figure 4 below.

Table 1

Global Competitive Index: MENA Nations

Country

Global Rank

Ranking Score

Kuwait

30

4.66

Qatar

31

4.63

Tunisia

32

4.59

Saudi Arabia

35

4.55

United Arab Emirates

37

4.50

Oman

42

4.43

Bahrain

43

4.42

Jordan

49

4.32

Morocco

64

4.08

Egypt

77

3.96

Figure 4. Global Competitive Index: MENA Nations

Source: Based on tabular data in Siddiqi, 2008 at p. 35

Notwithstanding these innovations in promoting a comprehensive e-government approach, there are several constraints in place that will benefit from the Web application addressed by this study and these issues are discussed further below.

2.3.

Management System

2.3.1.

Work Flow Management System. Besides Internet-based technologies, another extremely important basic technology for e-government is workflow management systems (WMS). According to Knaack and Gottsche (2004), workflow management systems make it possible to achieve the following functions:

1. Store documents electronically in electronic dossiers and files;

2. Access these at any time and from any place;

3. Electronically register and administer files, dossiers and documents, including the associated meta information (descriptive information);

4. Perform it-assisted processing of workflows through electronic instructions and signing determination of processing steps; documentation and logging of the case handling process and definition of detailed access rights and roles;

5. Integrate specialist operations and electronic files;

6. Create the preconditions to submission to the responsible archiving authorities and electronic archiving;

7. Ascertain the present processing status; and

8. Use different search tools.

Workflow management systems are thus workflow and document management systems that are geared particularly to the specific requirements of public administration. According to Runger and his associates (2007), "Document management systems (DMSs) are used for the creation, capturing, modification, storage and the propagation of electronic documents. In general DMSs are designed to assist organisations to manage the creation and flow of documents through the provision of a centralized repository. Many DMSs exist that are distinct in their base as well as extra functionality" (p. 192). Some of the primary benefits to be obtained from the introduction of workflow management systems together with document management systems include those described in Table 2 below.

Table 2

General Benefits of a Workflow and Document Management Systems

Benefit

Description

Increased transparency.

By electronically mapping processes and sequences it is possible not only to document and trace who did what, but there is also visibility of the processing status of dossiers and files. Moreover, the files can be accessed from any place and at any time and can be viewed and edited independently of the service unit involved (e.g. registry). Again, as far as the relationship between agency and customer (member of the public, company etc.) is concerned, it support for workflow management can increase transparency and hence customer friendliness. In this context, transparency means that the administrative flows become visible and customers can trace the processing status of a given administrative service.

Improved throughput.

Because the documents, dossiers and files are available in electronic form, they can be automatically forwarded by the workflow management system. This advantage applies also to any external parties involved, e.g. where a member of the public submits an electronic application. This reduces transportation times and increases the proportion of processing time that is spent adding value.

Greater efficiency.

As the case handling process is more transparent and throughput is faster, the efficiency with which cases are handled within the agency is significantly improved. A workflow management system can also improve efficiency in the cases which involve external third parties. The critical factors here are the fact that the procedure no longer entails any discontinuity of media and the possibility of initiating processes within the agency from outside (transaction orientation). Depending on the chosen implementation strategy, the benefits of a workflow management system vary at different times. The organizational and technical framework conditions are just as important here as it is to include the workforce in the implementation process and to support and train the future system users.

Higher staff motivation.

Staff motivation is essential to the successful implementation of workflow management projects. Improved efficiency can only be achieved if the workforce is actively involved. Motivation is critical to performance and the willingness to work. Personal responsibility and independence in the handling of cases can be increased through workflow management systems. Because meta information and processing information relating to dossiers and files is maintained in the system, the administrator is in a position to ascertain the processing status rapidly and comprehensively and, if necessary, to initiate appropriate measures.

Improved flexibility.

The use of workflow management systems makes it possible for clerical processing to be carried out decentrally, even though the processing steps necessary in a business routine depend on each other and are thus closely dovetailed. The use of workflow management systems introduces new possibilities for coordinating cooperation. This increases the flexibility of administrative work.

Source: Knaack & Gottsche, 2004, p. 6

2.3.1.1. Work Flow Management System Principles. Besides the general benefits of a workflow management system, the principles involved in the use of an intranet-based employee workflow management system in particular also allows employees to complete tasks and have them automatically forwarded to the next stage in the workflow process for review and/or for the addition of information (Hotte & Kingman, 2002). Yet another benefit of an intranet-based WMS is that it can provide training that can reach a large number of staff in a short amount of time. Recently, a state government initiative in the U.S. implemented an intranet for this purpose. Following significant revisions to a number of its key policies, it was able to use its intranet to post the changes online and provide immediate access for all of its staff members. With budget constraints and the need for better and faster communication, the intranet allows the department to meet the demands of staff and administration. This instant and easily accessible form of communication and training increases staff knowledge regarding key areas, which helps decrease possible liability concerns. Another benefit is the ability to offer links to outside training resources for staff to research or view new information (Hotte & Kingman, 2002).

Some of the basic principles involved with the use of an intranet-based workflow management system are described in Table 3 below.

Table 3

Principles of an Intranet-Based Workflow Management System

Advantage

Description

Improved training opportunities for staff

The intranet will help alleviate some of the issues and concerns of staff members concerning training requirements. Training now can be offered through e-learning via the intranet. This type of training is quickly becoming the standard. It allows staff flexibility in scheduling, eliminates long costly travel issues, and provides a variety of course offerings. Most studies show that e-learning actually cuts costs in training expenditures, while providing more training opportunities for staff.

Support and reference

Technology services, help desk information and support can be quickly reached through the intranet.

Rapid promulgation of ministry news, alerts and information

All current department news can be viewed on the intranet. Current newsletters as well as past issues are available for referencing. Statistical and research information can be quickly retrieved from the site. Any security issue can be displayed through an alert management system. Any archived alert may be reviewed at any time for referencing.

Policies and procedures

Through the intranet, MOD policies, procedures, directives and initiatives can be accessed instantly. Kuwaiti government standards would be available through the intranet for printing and review. Staff can access any of the MOD policies and Kuwait purchasing regulations through an easy-to-use menu. Included in the MOD would be a policy section is a history section of each policy that enables staff to reference old policies and compare changes to ensure that all new policy requirements are being met.

Human resource services

MOD employees would be able to access human resource information concerning benefits, policies, sick leave and so forth.

Source: Based on guidance in Hotte & Kingman, 2002

2.3.1.2. Work Flow Management System Tools. As noted in the introductory chapter, the WMS model developed by this study is based on a thin client server. According to Kobelius (2005), "Despite the ubiquity of Web browsers and the popularity of portals, access to many legacy applications is still based on older mechanisms, notably the 'thin' and 'thick' client models. From a network performance standpoint, the basic browser and the new enriched browsers sit midway between the relatively more chatty thin client and the relatively less chatty thick client models" (p. 44). All of these presentation-tier alternatives are capable of being operated side-by-side on the same physical client, such as a personal computer and they are complementary, rather than being mutually exclusive as described further in Table 4 below.

Table 4

Overview of Presentation Tier Options

Presentation Tier

Description

Thick Clients

The thick-client approach is often known as "client/server computing," although this term has been used so loosely for so long that it conceivably can be applied to all the presentation-tier approaches we discuss in this article. A thick-client device -- usually a PC -- runs applications locally, stores and processes data locally, and renders the presentation interface -- usually a GUI such as Microsoft Windows -- locally. Typical thick clients include desktop applications for email, collaboration, streaming video and RSS newsfeeds. The thick client's primary network interactions are with various specialized servers -- including file, database, and message servers -- which control access to various application services and content. These client/server interactions take place over various protocols, such as TCP/IP, UDP, FTP, and SMTP. At the risk of oversimplifying a complex set of application environments, "thick-client" traffic primarily consists of documents, files, records, messages and other content objects passing both ways between clients and servers. Generally, the traffic consists of data that clients render according to locally persistent application logic (unless that traffic includes HTML or other formats that encode for application semantics, in which case the thick client begins to resemble a browser). Given the broad range of thick-client architectures, it's difficult to make blanket generalizations about the network bandwidth or processing efficiency of this approach. Generally, however, thick client implementations are less bandwidth-intensive than browser-based options, and much less so than the thin-client approach.

Thin, Dumb and GUI

Thin clients typically process no application logic, persist no application data, and perform no rendering locally -- hence, the "thin" designation. Although they are generally the most bandwidth-intensive presentation-tier choice, their network burden depends on which vendor's thin-client environment you've implemented. Some assume a fast LAN/WAN connection, while others are designed to provide acceptable performance over both broadband and narrowband connections. Unlike Web browsers, which are built on industry standards, most thin-client protocols are proprietary. The principals include at & T's Virtual Network Computing (VNC); Citrix's Independent Computing Architecture (ICA); Microsoft's Remote Desktop Protocol (RDP); Sun Microsystems' Sun Ray; Tarantella's Adaptive Internet Protocol and the 1980s-era X Windows. The thin client is essentially a GUI-oriented update to the time-honored terminal-emulation approach. What gets pushed down to thin clients are detailed, real-time representations and refreshes -- usually in the form of vector graphics, drawing primitives, and raw pixels -- of GUI screens and events taking place on the servers. What gets passed back over the pipe are representations of keyboard entries and mouse clicks taking place on the client machines. On the server side of the thin-client environment, a "terminal server" typically front-ends the application server running the GUI-based application. The client only exists to present the GUI interface that was rendered by the server and to facilitate the user's remote interaction with that interface. The servers perform all application logic, data and rendering. The thin client may be implemented as a software component that installs on a PC or other traditional computer (in addition to other thin- and thick-client applications and browsers). It may be implemented on a standalone thin-client kiosk-type machine (as with the Sun Ray 1, which runs on the Sun Ray OS on a Sun machine). Alternately, thin client proxy software may be installed on a terminal server, interfacing on that machine to the terminal server software, with client access via a browser running the windows-terminal-emulation functionality through downloadable applets or other components. Clearly, there can be considerable architectural overlap between thin client and other presentation-tier approaches. Performance can vary widely among different thin clients.

The Thicker-Than-Thin Basic Browser:

Like thin clients, basic browsers specialize in presenting content rendered by and downloaded from servers, but browsers can be much more flexible. They handle presentation data differently and can display a wider range of formats (either natively or through browser plug-ins). Browsers also can upload content -- in the form of HTML forms and other objects -- back to servers. This ability, plus HTTP's core commands -- GET, PUT, and POST -- make browsers an integral part of Web-based ecommerce. In addition, browsers can persist some data locally in the browser cache, although they don't usually have the ability to do fine-grained, offline data manipulation. It is this ability to support persistent add-on components that most distinguishes the browser from the thin client and puts the browser closer to the thick-client end of the spectrum. Plug-ins are the critical feature that allows existing browsers to become enriched browsers.

Enriched Browsers:

The enriched browser delivers a more GUI-like user experience than a basic browser and shifts the presentation emphasis away from downloading individual Web pages, toward navigating within richer, structured, client-side content caches. Enriched browsers can even be set up as "personal portals," offloading many of the functions typically associated with online portals and making them available offline. This is made possible by the enriched browser's additional code that executes on the client PC and, in some cases, by an additional server in the data path. The enriched browser executes more application logic, caches more content and performs more rendering locally than a basic browser, offloading some of these functions from portals, websites and other presentation servers. Typically, an enriched browser is a plug-in to an existing browser, such as Microsoft Internet Explorer (IE), Netscape Navigator or Mozilla Firefox. The enriched browser usually works in conjunction with new "rich Internet application" (RIA) server software components, which may, and usually do, plug into existing portal, Web and/or application servers. Web applications must be written specifically to work with a given vendor's enriched browser plug-in and that same vendor's RIA presentation server. For example, Macromedia's Flash Player 7 can transform IE into an enriched browser when used with Macromedia's Flex 1.0 presentation server software. When equipped with Flash, IE can still function as a basic browser, and also interoperate with any standard portal, Web or application server (not just those that run Flex). Vendors of enriched browsing software include Macromedia, Laszlo, Nexaweb, Altio, RecipeXperience, Droplets, Curl, DreamFactory and ICE-soft. All except Curl and Dream Factory also provide runtime RIA presentation server software that integrates through various means with enterprises' existing portal servers, application servers, and/or Web servers. Some also include their own application servers.

Source: Kobelius, 2005, p. 45

2.3.1.3 Work Flow Management System Framework Implemented for Internal Use by the Ministry of Defense.

Web-based applications targeted at promoting e-government initiatives can be categorized with regard to their degree of cooperative support into the following levels: (a) Information; (b) Communication; and (c) Transaction. In this regard, Figure 5 below illustrates how e-government applications might be assigned to these three interaction levels followed by a more complete description in Table 5 below.

Figure 5. Examples of e-Government Applications

Source: Knaack & Gottsche, 2004, p. 8

Table 5

Description of the Three Levels of e-Government Applications

e-Government Application

Description

Information

The simplest form of cooperative support is the provision of information on the internet. On the agency's homepage or portal, simple content, such as the functions performed by the agency, the names of contact persons, how to get to the agency etc. is provided, if necessary, this information can be generated from documents held within the workflow management system and be used to provide agency-specific, generally valid information for members of the public or to provide the responsible persons with internal instructions.

Communication

At this second level, actions can also be performed. These include, for example, facilities for downloading forms, publications, legal texts and other information. The sending and receipt of e-mails is also assigned to this level of cooperative support. The benefits of a workflow management system as a basic component in e-government for this level arise from the possibility of communicating directly with the customer, especially as regards providing rapid information on the status of an ongoing proceeding. Long search times in the paper-based registry are eliminated, as the administrator concerned can access up-to-date data records from any place and at any time, subject only to that person's access rights, and can provide the member of the public seeking information with an immediate and consistent reply.

Chapter Introduction

This study used a mixed methodology to achieve the purpose described in the introductory chapter. The first part of the methodology consisted of a review of the relevant literature concerning secure workflow management systems in general and their use in developing a MOD e-tender application in particular. This approach is highly congruent a number of social researchers who emphasize the need to review what is known about a given topic in order to formulate informed opinions and develop new insights. For instance, Fraenkel and Wallen (2001) note that, "Researchers usually dig into the literature to find out what has already been written about the topic they are interested in investigating. Both the opinions of experts in the field and other research studies are of interest. Such reading is referred to as a review of the literature" (p. 48). In addition, a well conducted literature review can help identify gaps in the existing body of knowledge concerning a given topic. In this regard, Gratton and Jones (2003) emphasize that, "A literature review is the background to the research, where it is important to demonstrate a clear understanding of the relevant theories and concepts, the results of past research into the area, the types of methodologies and research designs employed in such research, and areas where the literature is deficient" (p. 51).

The second part of the mixed methodology consisted of empirical observations gained from the development of such a system, which called secure workflow management system (SWMS) for MOD e-tender application using the following steps:

1. Study system requirements and figure-out the type of processes needed.

2. Study important functionality that will be used to enrich both the Work flow and system security.

3. Study onion routing, PKI Capabilities and all level of security needed for such modle .

4. Develop secure workflow management system using onion routing.

5. Test the new SWM system web application.

6. Implement the SWM system web application

7. Compare the difference of using onion routing technique in the system compared to the usage of same system without it.

3.2.

RSA in e-Signature.

According to the application's vendor, "With the RSA Digital Signature technology application from RSA, enterprises can add secure and binding digital signature capabilities to electronic documents including web forms and Adobe® Acrobat® PDF files. By eliminating the inefficiencies of handwritten signatures, organizations can benefit from shorter transaction times, faster revenue recognition and reduced business process costs" (Digital signatures, 2009, p. 2). The RSA Digital Signature technology application allows organizations of all types and sizes to incorporate electronic signature capabilities to their electronic documents; in contrast to other types of electronic signatures, the digital signatures that are created using RSA Certificate Manager and employed with popular electronic document solutions (e.g., Adobe Acrobat), contain all of the features that characterize a legally binding, handwritten signature (Digital signatures, 2009). The vendor adds that, "They demonstrate intent, authenticate the signer, assure the integrity of the signed data and support non-repudiation of the transaction or communication" (Digital signatures, 2009, p. 3). Consequently, administrative requirements that need signatures (i.e., employee expense reports, health insurance forms, or in the instant case, tender offer certificates) can be adapted to the RSA e-signature approach which provides a secure, end-to-end electronic processes, thereby permitting organizations to enjoy the wide range of benefits that can be realized through e-governmental processes (Digital signatures, 2009). In sum, the vendor concludes that, "The Digital Signature technology application is engineered to easily integrate digital signing into existing electronic document-based business processes" (Digital signatures, 2009, p. 4).

Some of the benefits that accrue to the use of RSA for e-signatures are shown in Table 7 below.

Table 7

Benefits of Using RSA for e-Signatures

Benefit

Description

Closing the Electronic Loop Makes Organizations More Efficient

With the ability to digitally sign electronic documents and forms, businesses and governments (especially those in the financial services and healthcare industries, where issues of privacy and identity are paramount) can streamline critical transaction processes. No longer is the electronic loop "broken" by having to move a key part of the transaction offline. This helps users to reduce administrative costs; become more responsive; provide better service to customers, partners and suppliers; and mitigate risk.

Electronic-Based Processes Can Lead to Increased Revenues

Organizations can complete transactions much more quickly and efficiently within an end-to-end electronic process. This puts revenues in the books in real time, rather than waiting until paper forms are received and processed. The increased convenience for customers, partners and suppliers can build loyalty and spur the transfer of a growing share of business transactions online. Without the ability to digitally sign electronic documents and forms, users may procrastinate or decide not to return the paper form they were made to print -- thereby causing organizations to lose potential revenues.

Digital Signatures Enable Safe, Secure Transactions

Just like handwritten signatures, digital signatures demonstrate the signer's intent to accept the terms of the document being signed. Further, the Digital Signature technology application delivers risk-mitigating protection by authenticating the signer's identity, validating the signer's digital certificate and detecting if any changes have been made to the content of the document once it is signed. This ensures that transactions completed with digital signatures support the requirements of non-repudiation that make handwritten signatures binding for business.

Support Compliance

The RSA Digital Signature technology application can help enterprises comply with the growing body of legislation and regulations governing electronic and digital signatures, including: E-SIGN, HIPAA, 21 CFR Part 11, U.S. Government's Paperwork Elimination Act, EU Directive on Electronic Signatures.

Source: Digital signatures, 2009, p. 3

3.3.

Onion Routing.

Researchers have made significant progress in the design and development of technical parameters that are needed for the security of online data. According to Cohen, "Object-oriented programming techniques make it possible to endow individual items of data with broad ranges of attributes that specify the sorts of processing permitted. Personally-identified data can be encoded with detailed information about restrictions on use and exchange, or encased within digital firewalls that prevent its aggregate extraction in personally-identified form" (2000, p. 1373). Moreover, digital technologies exist that allow the construction of so-called "technologies of identity" which are transactional systems that function anonymously or pseudonymously and therefore preclude personally-identified data from being collected at all (Cohen, 2000). For this purpose, onion routers were developed just over a decade ago by researchers at the U.S. Naval Research Laboratory in an effort to provide enhanced security of governmental data maintained online. The researchers at the U.S. Naval Research Laboratory developed a system that they termed, "Onion Routing" that is freely available and allows anyone to use a network of onion routers (Forte, 2006, p. 85).

3.4.

Hardware and System Level of Security

As noted above, for e-signature technique, the Web application will use PKI-based credentials, available either on external hardware tokens or as software installed directly on a client computer, to digitally sign an electronic document. When a user accesses a document in Acrobat or Reader, opening it and clicking the signature field, the solution presents the available credentials for signing. Alternatively, roaming credentials can be used to provide additional flexibility to sign without a hardware-based certificate such as a smart card or token. The signing keys are stored on a centralized, hardened server. Hardware tokens are physical devices that authorized users possess to store cryptographic keys and to aid in authentication. They come in a variety of form factors and are typically small enough to be carried in a pocket or purse. In most cases, a PIN or password may be required for two-factor authentication.

4.0. Chapter 4: Implementation and Design

4.1.

Chapter Introduction

This chapter presents an overview of the system requirements needed to achieve the goals of the study, including a description of the hardware and software required. An overview of the system design including requisite systems elements and their description and the algorithm used to develop the system is followed by a use case diagram and class diagram. A description of the implementation process used for these components concludes this chapter.

4.2

System Requirements: Hardware and Software

The Web application will use a Java Server Page (JSP) for its user interface because this approach provides one of the most powerful programming languages available that can be used to build an internet application. It takes its power from using java as an imbedded language in it. Perhaps Jsp will be more difficult for me to learn rather than other language we had studied, but it is great reputation makes me take this challenge. I will consider this as a learning outcome and will take place in my project schedule.

The study used Oracle as its database because Oracle is a widely used, secure database, and its use will provide a first class RDBMS with easy-to-have technical support in addition it is applied in of communication. In addition, the project used the lastest version available of Jsp. Further, the use of a WFMS application that allows users to program multilevel mission logic, securely coordinate widely distributed tasks, and monitor the progress of the workflow across classification domains is also required.

4.3

System Design

4.3.1. System Elements and Description

4.3.2 Algorithm

4.4

Use Case Diagram.

4.5

Class Diagram

4.6

Implementation

5.0. Chapter 5: Analysis and Conclusions

5.1.

Analysis

The research was consistent in emphasizing that e-governmental operations are worthwhile endeavors, but there is more to the process than simply transferring government operations to an online format in a wholesale fashion. Rather, the entire process must be evaluated to identify important stakeholders and what information they need to make the system function efficiently while ensuring that adequate security measures are in place to avoid unauthorized access to sensitive information. The research was also consistent in showing that properly conducted, online tender offers provide a wide range of benefits that would help the Kuwaiti Ministry of Defense streamline its operations, reduce the amount of paperwork currently involved and facilitate the process for vendors and internal customers alike. In addition, the research showed that Web technology can support distributed information creation and management that all components are updated in a real-time fashion in ways that are not possible using a paper-driven administrative approach. Using Web-based applications provides the means for information content to be as current as possible while allowing access by those who need it while preventing access by those who are not authorized to do so. These attributes make the intranet developed in this study a timely and relevant project that can help support the mission of the Kuwaiti Ministry of Defense in substantive ways.

5.2.

Conclusions

It is reasonable to conclude that while the march to ubiquitous computing continues and much of the technology that is currently regarded as state of the art will be replaced in the years to come, Web-based applications and intranets has been shown time and again to provide a wide range of useful benefits for administration and staff in the ongoing pursuit of better information management (Hotte & Kingman, 2002).

5.3.

Lessons Gained

Perhaps the overriding lesson learned from this project was the need for security and authentication processes that can protect sensitive information from unauthorized access while still maintained a system that is sufficiently open that it provides access by virtually anyone who is interested in taking part in a tender offer. Current security approaches can be likened to the castles of old where siege machinery would be developed to overcome new defenses as soon as they were in place. Hackers and crackers are constantly looking for glitches and weaknesses in security protocols and frequently find them. In a military headquarters environment, though, such security breaches are unacceptable and the need for constant review of existing security methods must be regarded as a top priority when Web-based applications are introduced.

5.4.

Future Work

Noticeably absent from the Kuwaiti government e-government efforts to date has been a survey of user preferences to identify opportunities for improving the delivery of governmental services to citizens, non-citizen residents and commercial vendors. To this end, future work should involve periodic, regular surveys, both online and mailed, to all stakeholders of the e-government initiatives to ensure that these systems are accomplishing what they are intended to accomplish and are providing the range of services desired by their users.