Specification and querying of security constraints in the EFSOC framework

ABSTRACT

Service-Oriented Computing is a new paradigm for the specification and deployment of distributed services in highly dynamic environments. The very nature of the context in which service-oriented computing thrives imposes unique security requirements. Large scale interconnection of systems and services, rapidly changing service compositions and ad-hoc composition and invocation of services require a flexible security model that is able to adapt to these changes. In this paper, we present an approach to specification and querying of security (access control) constraints in the context of the event-driven framework for service-oriented computing.

REFERENCES

• 1: B. Atkinson, G. Della-Libera, S. Hada, M. Hondo, P. Hallam-Baker, J. Klein, B. LaMacchia, P. Leach, J. Manferdelli, H. Maruyama, A. Nadalin, N. Nagaratnam, H. Prafullchandra, J. Shewchuk, and D. Simon. Web services security (ws-security). Technical report, Microsoft, IBM and Verisign, April 2002.
• 2: Reinhardt A. Botha , Jan H. P. Eloff, Separation of duties for access control enforcement in workflow environments, IBM Systems Journal, v.40 n.3, p.666-682, March 2001
• 3: D. Box, F. Curbera, M. Hondo, C. Kaler, D. Langworthy, A. Nadalin, N. Nagaratnam, M. Nottingham, C. von Riegen, and J. Sewchuck. Web services policy framework (ws-policy). Technical report, BEA Systems Inc., International Business Machines Corporation, Microsoft Corporation, SAP AG, May 2003.
• 4: N. C. S. Center. A guide to understanding discretionary access control in trusted systems. Technical Report Library No. S-228,576, September 1987.
• 5: S. Farell, I. Reid, H. Lockhart, D. Orchard, K. Sankar, C. Adams, T. Moses, N. Edwards, J. Pato, B. Blakley, M. Erdos, S. Cantor, R. B. Morgan, M. Chanliau, C. McLaren, C. Knouse, S. Godik, D. Platt, J. Moreh, J. Hodges, and P. Hallam-Baker Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) V1.1. Committee specification, OASIS, July 2003. http://www.oasis-open.org/committees/documents.php?wg_abbrev=security.
• 6: S. Godik and T. M. (editors). eXtensible Access Control Markup Language (XACML). OASIS Standard, OASIS, February 2003.
• 7: S. E. Hudson. Cup parser generator for java. Technical report, GVU Center, Georgia Tech, 1999.
• 8: Matthias Jarke , Rainer Gallersdörfer , Manfred A. Jeusfeld , Martin Staudt , Stefan Eherer, ConceptBase—a deductive object base for meta data management, Journal of Intelligent Information Systems, v.4 n.2, p.167-192, March 1995 [doi>10.1007/BF00961873]
• 9: G. Klein. Jflex - the fast scanner generator for java. Technical report, April 2004.
• 10: Kees Leune , Willem-Jan van den Heuvel , Mike Papazoglou, Exploring a Multi-Faceted Framework for SoC: How to Develop Secure Web-Service Interactions?, Proceedings of the 14th International Workshop on Research Issues on Data Engineering: Web Services for E-Commerce and E-Government Applications (RIDE'04), p.56-61, March 28-29, 2004
• 11: David C. Luckham, The Power of Events: An Introduction to Complex Event Processing in Distributed Enterprise Systems, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2001
• 12: Micki Krause, Handbook of Information Security Management 1999, CRC Press, Inc., Boca Raton, FL, 1999
• 13: John Mylopoulos , Alex Borgida , Matthias Jarke , Manolis Koubarakis, Telos: representing knowledge about information systems, ACM Transactions on Information Systems (TOIS), v.8 n.4, p.325-362, Oct. 1990 [doi>10.1145/102675.102676]
• 14: D. of Defense. Trusted computer system evaluation criteria. Technical Report Library No. S225,711, December 1985.
• 15: J. Saltzer and M. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 63(9):1278 -- 1308, September 1975.
• 16: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 17: Ravi Sandhu , David Ferraiolo , Richard Kuhn, The NIST model for role-based access control: towards a unified standard, Proceedings of the fifth ACM workshop on Role-based access control, p.47-63, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344301]
• 18: M. Wahl, T. Howes, and S. Kille. Lightweight directory access protocol (v3). Technical Report RFC 2251, Critical Angle Inc., Netscape Communications Corp., Isode Limited, December 1997. http://www.ietf.org/rfc/rfc2251.txt.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

General Terms:
Security

Keywords:
EDL, EFSOC, role-based access control, service-oriented computing