Security views for outsourced business processes

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 45-52

  Benameur, Azzedine ^a   Massacci, Fabio ^b   Rassadko, Nataliya ^b  

^a SAP Research Security and Trust   (France)

^b UNIVERSITY OF TRENTO   (Italy)

Author keywords

Access control; Business process; Electronic commerce; Security view; Workflow

Indexed keywords

AUTOMATIC DERIVATION; BUSINESS PROCESS; CLEARANCE LEVEL; RELATIONAL DATABASE; SECURITY VIEW; VIRTUAL ORGANIZATION; VIRTUAL VIEW; WORKFLOW; WORKFLOW VIEWS;

ACCESS CONTROL; ELECTRONIC COMMERCE; MANAGEMENT; SECURITY SYSTEMS; WEB SERVICES;

PROCESS CONTROL;

EID: 70349256454     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1456492.1456500     Document Type: Conference Paper

References (30)

1. G. Alonso, U. Fiedler, C. Hagen, A. Lazcano, H. Schuldt, and N. Weiler.Wise: Business to business e-commerce. In Proceedings of the Ninth International Workshop on Research Issues on Data Engineering: Information Technology for Virtual Enterprises (RIDE'99), page 132, Washington, DC, USA, 1999. IEEE Computer Society.
2. Apache axis2 web service engine. http://ws.apache.org/axis2/modules/ rampart/1-2/securitymodule.html, 2007.
3. L. Baresi, A. Maurino, and S. Modafferi. Towards distributed BPEL orchestrations. In Third Workshop on Software Evolution through Transformations: Embracing the Change (SETRa'06). Electronic Communications of the EASST, 2006.
4. E. Bertino, E. Ferrari, and V. Atluri. The specification and enforcement of authorization constraints in workflow management systems. ACM Transactions on Information and System Security, 2(1):65-104, 1999.
5. W. Binder, I. Constantinescu, and B. Faltings. Decentralized orchestration of compositeweb services. In Proceedings of the IEEE International Conference on Web Services (ICWS'06), pages 869-876, Washington, DC, USA, 2006. IEEE Computer Society.
6. Business process execution language v2.0, 2007. http://docs.oasis-open. org/wsbpel/2.0/wsbpel-v2.0.pdf.
7. D. W. Chadwick and A. Otenko. The PERMIS X.509 role based privilege management infrastructure. In Proceedings of the seventh ACM symposium on Access control models and technologies (SACMAT'02), pages 135-140, New York, NY, USA, 2002. ACM.
8. D. W. Chadwick, W. Xu, S. Otenko, R. Laborde, and B. Nasser. Multi-Session Separation of Duties (MSoD) for RBAC. In First International Workshop on Security Technologies for Next Generation Collaborative Business Applications (SECOBAP'07), Istanbul, Turkey, April 2007.
9. G. B. Chafle, S. Chandra, V. Mann, and M. G. Nanda. Decentralized orchestration of composite web services. In Proceedings of the 13th international World Wide Web conference on Alternate track papers & posters (WWW'04), pages 134-143, New York, NY, USA, 2004. ACM.
10. D. K. W. Chiu, S. C. Cheung, S. Till, K. Karlapalem, Q. Li, and E. Kafeza. Workflow view driven cross-organizational interoperability in a web service environment. Information Technology and Management, 5(3-4):221-250, 2004.
11. D. K. W. Chiu, S. C. Cheung, S. Till, K. Karlapalem, Q. Li, and E. Kafeza. Workflow view driven cross-organizational interoperability in a web service environment. Inf. Technol. and Management, 5(3-4):221-250, 2004.
12. D. K. W. Chiu, Z. Shan, P. C. K. Hung, and Q. Li. Designing workflow views with flows for large-scale business-to-business information systems. In Technologies for E-Services (TES'04), pages 107-121. Springer, 2004.
13. G. Goth. The ins and outs of it outsourcing. IT Professional, 1:11-14, 1999.
14. P. Grefen, K. Aberer, Y. Hoffner, , and H. Ludwig. CrossFlow: Cross-organizational workflow management in dynamic virtual enterprises. Int. Journal of Computer Systems Science and Engineering, 15(5), 2000.
15. S. Jablonski, R. Schamburger, C. Hahn, S. Horn, R. Lay, J. Neeb, and M. Schlundt. A comprehensive investigation of distribution in the context of workflow management. In Proceedings of the Eighth International Conference on Parallel and Distributed Systems (ICPADS'01), page 187, Washington, DC, USA, 2001. IEEE Computer Society.
16. E. Kafeza, D. K. W. Chiu, and I. Kafeza. View-based contracts in an e-service cross-organizational workflow environment. In Proceedings of the Second International Workshop on Technologies for E-Services (TES'01), pages 74-88, London, UK, 2001. Springer-Verlag.
17. M. H. Kang, J. S. Park, and J. N. Froscher. Access control mechanisms for inter-organizational workflow. pages 66-74, 2001.
18. Y. Karabulut, F. Kerschbaum, F. Massacci, P. Robinson, and A. Yautsiukhin. Security and trust in it business outsourcing: a manifesto. In S. Etalle and P. Samarati, editors, Proceedings of STM'06, 2006.
19. G. Karjoth, B. Pfitzmann, M. Schunter, and M. Waidner. Service-oriented Assurance - Comprehensive Security by Explicit Assurances. 2005.
20. H. Li and Z. Lu. Decentralized workflow modeling and execution in service-oriented computing environment. In Proceedings of the IEEE International Workshop on Service-Oriented System Engineering(SOSE'05), pages 29-36, Washington, DC, USA, 2005. IEEE Computer Society.
21. C. Mohan, G. Alonso, R. Gunthor, and M. Kamath. Exotica: A research perspective ob workflow management systems. Data Engineering Bulletin, 18(1):19-26, 1995.
22. P. Muth, D. Wodtke, J. Weissenfels, A. K. Dittrich, and G. Weikum. From centralized workflow specification to distributed workflowexecution. Journal of Intelligent Information Systems, 10(2):159-184, 1998.
23. M. Reichert and P. Dadam. ADEPT flex -supporting dynamic changes of workflows without losing control. Journal of Intelligent Information Systems, 10(2):93-129, 1998.
24. G. Riempp. Wide Area Workflow Management: Creating Partnerships for the 21st Century. Springer-Verlag New York, Inc., Secaucus, NJ, USA, 1999.
25. J. H. Saltzer and M. D. Schroeder. The protection of information in computer systems. Proceedings of IEEE, 9(63):1278-1308, 1975.
26. A. Schaad, V. Lotz, and K. Sohr. A model-checking approach to analysing organisational controls in a loan origination process. In SACMAT '06: Proceedings of the eleventh ACM symposium on Access control models and technologies, pages 139-149, New York, NY, USA, 2006. ACM.
27. K. A. Schulz and M. E. Orlowska. Facilitating cross-organisational workflows with a workflow view approach. Data Knowledge Engineering, 51(1):109-147, 2004.
28. Z. Shan, D. K. W. Chiu, and Q. Li. Systematic interaction management in a workflow view based business-to-business process engine. In Proceedings of the Proceedings of the 38th Annual Hawaii International Conference on System Sciences (HICSS'05) - Track 7, page 162.2, Washington, DC, USA, 2005. IEEE Computer Society.
29. W. Tan and Y. Fan. Decentralized workflow execution for virtual enterprises in grid environment. In Proceedings of the Fifth International Conference on Grid and Cooperative Computing Workshops (GCCW'06), pages 308-314. IEEE Computer Society, 2006.
30. U. Yildiz and C. Godart. Information flow control with decentralized service compositions. In IEEE International Conference on Web Services (ICWS'07), pages 9-17, Washington, DC, USA, 2007. IEEE Computer Society.