Middleware support for auditing service process flows

ABSTRACT

The ever increasing security and privacy concerns require organizations to strictly comply with the regulations and the guidelines. Similar to any other part of an organization, it is necessary to conduct audits to determine whether the IT systems are in compliance. We specifically focus on the IT systems that are founded on Service Oriented Computing (SOC) principals. In a service oriented system both the internal and the external services may easily interact with each other, which may make the establishment and the enforcement of the privacy policies and the rules across the systems increasingly challenging. We introduce efficient and flexible methods for auditing such systems by leveraging the middleware platform capabilities. We show how the service process flows that have been executed in the system can be audited both based on their structure and the information that is disclosed by them.

REFERENCES

• 1: M. Altunay, D. Brown, G. Byrd, and R. Dean. Trust-Based Secure Workflow Path Construction. In Proc. of Intl. Conf. on Service Oriented Computing (ICSOC), 2005.
• 2: W. Cui, V. Paxon, N. C. Weaver, and R. H. Katz. Protocol-Independent Adaptive Replay of Application Dialog. In Proc. of Network and Distributed System Security Symposium, 2006.
• 3: DAO. Data Access Objects. http://java.sun.com/blueprints/corej2eepatterns/Patterns/DataAccessObject.html.
• 4: Martin Deubler , Johannes Grünbauer , Jan Jürjens , Guido Wimmel, Sound development of secure service-based systems, Proceedings of the 2nd international conference on Service oriented computing, November 15-19, 2004, New York, NY, USA [doi>10.1145/1035167.1035185]
• 5: GLB. Gramm-Leach-Bliley Act. http://banking.senate.gov/conf/.
• 6: HIPAA. Health Insurance Portability and Accountability Act. http://wwww.hhs.gov/ocr/hipaa.
• 7: JDO. Java Data Objects. http://java.sun.com/products/jdo/.
• 8: C. Krugel and T. Toth. Distributed Pattern Detection for Intrusion Detection. In Proc. of Network and Distributed System Security Symposium, 2002.
• 9: Sarbanes-Oxley Act. Public Company Accounting Reform and Investor Protection Act. Pub. L. No. 107--204, 116 Stat. 745.
• 10: SDO. Service Data Objects. http://www-128.ibm.com/developerworks/webservices/library/specification/ws-sdo/.
• 11: The European Union Privacy Directive. Directive 95/46/EC of the European Parliament and of the Council. http://www.cdt.org/privacy/eudirective/EU_Directive_html
• 12: B. Waters, D. Balfanz, and G. D. D. K. Smetters. Building an Encrypted and Searchable Audit Log. In Proc. of Network and Distributed System Security Symposium, 2004.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
        D.2.11 Software Architectures

General Terms:
Design, Security

Keywords:
auditing, middleware, privacy, security, service oriented computing