Refactoring service-based systems: How to avoid trusting a workflow service

Concurrency and Computation: Practice and Experience

Volumn 18, Issue 10, 2006, Pages 1255-1275

  Chivers, Howard ^a   McDermid, John ^a  

^a UNIVERSITY OF YORK   (United Kingdom)

Author keywords

Grid; Pattern; Refactoring; Security; Service based architectures; Web services; Workflow

Indexed keywords

COMPUTER APPLICATIONS; COMPUTER SYSTEMS; CONSTRAINT THEORY; SECURITY OF DATA;

GRID; PATTERN; REFACTORING; SERVICE-BASED ARCHITECTURES; WEB SERVICES; WORKFLOW;

DATA STRUCTURES;

EID: 33747510016     PISSN: 15320626     EISSN: 15320634     Source Type: Journal    
DOI: 10.1002/cpe.997     Document Type: Conference Paper

References (27)

1. Jackson T, Austin J, Fletcher M, Jessop M. Delivering a Grid enabled Distributed Aircraft Maintenance Environment (DAME). Proceedings of the UK e-Science All Hands Meeting 2003, Nottingham, U.K. EPSRC: Swindon, 2003. Available at: http://www.nesc.ac.uk/events/ahm2003/AHMCD/ [27 February 2005].
2. Ferguson DF, Storey T, Lovering B, Shewchuk J. Secure, Reliable, Transacted Web Service: Architecture and Composition, IBM/Microsoft, 28 October 2003. ftp://www6.software.ibm.com/software/developer/library/ws-securtrans.pdf [27 February 2005].
3. Andrews T et al. Business Process Execution Language for Web Services, BEA Systems, International Business Machines Corporation, Microsoft Corporation, SAP AG, Siebel Systems, 5 May 2003. ftp://www6.software.ibm.com/software/developer/library/ws-bpel.pdf [27 February 2005].
4. Schulze W, Bussler C, Meyer-Wegener K. Standardising on workflow-management - the OMG workflow management facility. ACM SIGGROUP Bulletin 1988; 19(1):24-30.
5. Atluri V. Security for workflow systems. Information Security Technical Report 2001; 6(2):59-68.
6. Herrmann G, Pernul G. Toward security semantics in workflow management. Proceedings of the 31st Annual Hawaii International Conference on System Sciences, Kohala Coast, HI. IEEE Computer Society Press: Washington, DC, 1998.
7. Workflow Security Consideration - White Paper, Workflow Management Coalition, WFMC-TC-1019, February 1998.
8. Botha RA, Eloff JHP. A security interpretation of the workflow reference model. Proceedings of the Information Security-from Small Systems to Management of Secure Infrastructures, Vienna, Austria, 1988, vol. 2. IEEE Computer Society Press: Washington, DC, 1998; 43-51.
9. Bertino E, Ferrari E, Atluri V. The specification and enforcement of authorization constraints in workflow management systems. ACM Transactions on Information and System Security (TISSEC) (Special Issue on Role-based Access Control) 1999; 2(1):65-104.
10. Wainer J, Barthelmess P, Kumar A. W_RBAC - a workflow security model incorporating controlled overriding of constraints. International Journal of Cooperative Information Systems 2003; 12(4):455-485.
11. Davulcu H, Kifer M, Pokorny LR, Ramakrishnan CR, Ramakrishnan IV, Dawson S. Modeling and analysis of interactions in virtual enterprises. Proceedings of the 9th International Workshop on Research Issues on Data Engineering, Sydney. Australia, 1999. IEEE Computer Society Press: Washington, DC, 12-18.
12. Kang MH, Park JS, Froscher JN. Access control mechanisms for inter-organizational workflow. Proceedings of the 6th ACM Workshop on Role Based Access Control, Chantilly, VA, 2001. ACM Press: New York; 66-74.
13. Gudes E, Olivier M, Riet RPvd. Modelling, specifying and implementing workflow security in cyberspace. Journal of Computer Security 1999; 7(4):287-315.
14. Hung PCK, Karlapalem K. A secure workflow model. Proceedings of the Australasian Information Security Workshop Conference on ACSWFrontiers, Adelaide, Australia. Australian Computer Society: Sydney, 2003; 33-41.
15. Huang W-K, Atluri V. SecureFlow: A secure Web-enabled workflow management system. Proceedings of the 4th ACM Workshop on Role-based Access Control, Fairfax, VA, 1999. ACM Press: New York, 1998; 83-94.
16. Long DL, Baker J, Fung F. A prototype secure workflow server. Proceedings of the 15th Annual Computer Security Applications Conference, Phoenix, AZ, 1999. IEEE Computer Society Press: Washington, DC, 1999; 129-133.
17. Fowler M. Refactoring: Improving the design of existing code (The Addison-Wesley Object Technology Series). Addison-Wesley-Longman: Reading, MA, 1999.
18. Stepney S, Polack F, Toyn I. A Z Patterns Catalogue 1: Specification and refactorings, v0.1. Technical Report YCS-2003-349, University of York, 2003.
19. Mens T, Tourwé T. A survey of software refactoring. IEEE Transactions on Software Engineering 2004; 30(2):126-139.
20. Viega J, McGraw G. Building Secure Software: How to Avoid Security Problems the Right Way (Professional Computing). Addison-Wesley: Reading, MA, 2001.
21. Gamma E, Helm R, Johnson R, Vissides J. Design Patterns: Micro-architectures for Reusable Object-oriented Software (APC). Addison-Wesley: Reading, MA, 1994.
22. Blakley B, Heath C (eds.). Security Design Patterns. The Open Group, 2004. Available at: http://www.opengroup.org/publications/catalog/g031.htm [27 February 2005]; 102.
23. Heuser M, Fernandez EB. RFC Client: A pattern for the client-side implementation of a pipelined request/respone protocol. Proceedings of the Pattern Languages of Programs 1999 (PLoP 99), Urbana, IL, 1999. Available at: http://st-www.cs.uiuc.edu/~plop/plop99/proceedings/ [27 February 2005].
24. Clark DD, Wilson DR. A comparison of commercial and military computer security policies. Proceedings of the 1987 IEEE Symposium on Security and Privacy, Oakland, CA, 1987. IEEE Computer Society Press: Washington, DC, 1987; 184-194.
25. Claessens J, Preneel B, Vandewalle J. Anonymity controlled electronic payment system. Proceedings of the 20th Symposium on Information Theory in the Benelux, Haasrode, Belgium. Technical University of Delft (NL), Information Theory Department, 1999; 109-116.
26. Web Services Security v 1.0 (WS-Security 2004), OASIS, 2004. http://www.oasis-open.org/specs/index.php#wssv1.0 [27 February 2005].
27. Milosevic Z, Arnold D, O'Connor L. Inter-enterprise contract architecture for open distributed systems: Security requirements. Proceedings of the 5th International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE'96), Stanford, CA. IEEE Computer Society: Washington, DC, 1996.