Enforcement of entailment constraints in distributed service-based business processes

Information and Software Technology

Volumn 55, Issue 11, 2013, Pages 1884-1903

  Hummer, Waldemar ^a   Gaubatz, Patrick ^b   Strembeck, Mark ^c   Zdun, Uwe ^b   Dustdar, Schahram ^a  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

^b UNIVERSITY OF VIENNA   (Austria)

^c VIENNA UNIVERSITY OF ECONOMICS AND BUSINESS   (Austria)

Author keywords

Architecture (SOA); Business process management; Entailment constraints; Identity and access management; Service Oriented; WS BPEL

Indexed keywords

BUSINESS PROCESS MANAGEMENT; ENTAILMENT CONSTRAINTS; IDENTITY AND ACCESS MANAGEMENTS; SERVICE ORIENTED; WS-BPEL;

ENTERPRISE RESOURCE MANAGEMENT; INFORMATION SERVICES; PROBLEM ORIENTED LANGUAGES; SERVICE ORIENTED ARCHITECTURE (SOA); SPECIFICATIONS;

WEB SERVICES;

EID: 84884150946     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2013.05.001     Document Type: Article

References (86)

1. D. Draheim The service-oriented metaphor deciphered JCSE 4 4 2010 253 275
2. M. Huhns, and M. Singh Service-oriented computing: key concepts and principles IEEE Internet Computing 9 2005 75 81
3. M.P. Papazoglou, P. Traverso, S. Dustdar, and F. Leymann Service-oriented computing: state of the art and research challenges IEEE Computer 40 11 2007 38 45
4. World Wide Web Consortium (W3C), Web services activity < http://www.w3.org/2002/ws/ >.
5. P. Leitner, W. Hummer, and S. Dustdar Cost-based optimization of service compositions IEEE Transactions on Services Computing 99 2011 1 (Preprint)
6. J. Cannon, and M. Byers Compliance deconstructed ACM Queue 4 7 2006 30 37
7. M. Damianides How does SOX change IT? Journal of Corporate Accounting & Finance 15 6 2004 35 41
8. S. Mishra, and H. Weistroffer A framework for integrating sarbanes-oxley compliance into the systems development process Communications of the Association for Information Systems (CAIS) 20 1 2007 712 727
9. D.F. Ferraiolo, D.R. Kuhn, and R. Chandramouli Role-Based Access Control second ed. 2007 Artech House
10. R. Sandhu, E. Coyne, H. Feinstein, and C. Youman Role-based access control models Computer 29 2 1996 38 47
11. M. Strembeck, A role engineering tool for role-based access control, in: 3rd Symposium on Requirements Engineering for Information Security, 2005.
12. M. Strembeck Scenario-driven role engineering IEEE Security & Privacy 8 1 2010 28 35
13. J. Wainer, P. Barthelmes, and A. Kumar W-RBAC - a workflow security model incorporating controlled overriding of constraints International Journal of Cooperative Information Systems 12 4 2003 455 485
14. M. Strembeck, and J. Mendling Modeling process-related RBAC models with extended UML activity models Information and Software Technology 53 5 2011 456 483
15. D. Clark, D. Wilson, A comparison of commercial and military computer security policiesi, in: IEEE Symposium on Security and Privacy, 1987.
16. E. Bertino, E. Ferraria, and V. Atluri The specification and enforcement of authorization constraints in workflow management systems ACM Transactions on Information and System Security 2 1 1999 65 104
17. R. Botha, and J. Eloff Separation of duties for access control enforcement in workflow environments IBM Systems Journal 40 3 2001 666 682
18. K. Tan, J. Crampton, C. Gunter, The consistency of task-based authorization constraints in workflow systems, in: 17th IEEE Workshop on Computer Security Foundations (CSFW), 2004, pp. 155-169.
19. M. Strembeck, J. Mendling, Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context, in: 18th International Conference on Cooperative Information Systems (CoopIS), 2010.
20. C. Wolter, A. Schaad, and C. Meinel Task-based entailment constraints for basic workflow patterns 13th ACM Symposium on Access Control Models and Technologies (SACMAT) 2008 ACM 51 60
21. W. Hummer, P. Gaubatz, M. Strembeck, U. Zdun, S. Dustdar, An integrated approach for identity and access management in a SOA context, in: 16th ACM Symposium on Access Control Models and Technologies (SACMAT), 2011, pp. 21-30.
22. D.C. Schmidt Guest editor's introduction: model-driven engineering IEEE Computer 39 2 2006 25 31
23. B. Selic The pragmatics of model-driven development IEEE Software 20 5 2003 19 25
24. T. Stahl, and M. Völter Model-Driven Software Development 2006 John Wiley & Sons
25. M. Mernik, J. Heering, and A. Sloane When and how to develop domain-specific languages ACM Computing Surveys 37 4 2005 316 344
26. D. Spinellis Notable design patterns for domain-specific languages Journal of Systems and Software 56 1 2001 91 99
27. U. Zdun, M. Strembeck, Reusable architectural decisions for dsl design: foundational decisions in DSL projects, in: 14th European Conference on Pattern Languages of Programs (EuroPLoP), 2009.
28. M. Strembeck, U. Zdun, An approach for the systematic development of domain-specific languages, Software: Practice and Experience 39 (15) (2009).
29. T. Mens, and P.V. Gorp A taxonomy of model transformation Electronic Notes in Theoretical Computer Science 152 2006 125 142
30. S. Sendall, W. Kozaczynski, Model transformation: the heart and soul of model-driven software development, IEEE Software 20 (5) (2003).
31. U. Zdun, M. Strembeck, Modeling composition in dynamic programming environments with model transformations, in: 5th International Symposium on Software Composition, 2006.
32. Object Management Group, UML 2.4.1 Superstructure, August 2011 < http://www.omg.org/spec/UML/2.4.1 >.
33. OASIS, Web Services Business Process Execution Language, 2007 < http://docs.oasis-open.org/wsbpel/2.0/OS >.
34. OASIS, Security Assertion Markup Language, March 2005 < http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf >.
35. World Wide Web Consortium, SOAP Messaging Framework, 2007 < http://www.w3.org/TR/soap12-part1/ >.
36. C. Wolter, M. Menzel, A. Schaad, P. Miseldine, and C. Meinel Model-driven business process security requirement specification Journal of Systems Architecture 55 2009 211 223
37. Object Management Group, Meta Object Facility (MOF) 2.0 Query/View/Transformation Specification (January 2011). URL: http://www.omg.org/spec/QVT/.
38. OASIS, Metadata for the OASIS Security Assertion Markup Language (SAML), 2005 < http://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf >.
39. World Wide Web Consortium (W3C), XSL Transformations (XSLT) Version 2.0, 2007 < http://www.w3.org/TR/xslt20/ >.
40. B. Hoisl, and M. Strembeck A UML extension for the model-driven specification of audit rules 2nd International Workshop on Information Systems Security Engineering (WISSE) 2012 Springer Verlag
41. World Wide Web Consortium (W3C), XQuery 3.0: An XML Query Language, 2011 < http://www.w3.org/TR/xquery-30/ >.
42. W. Hummer, P. Leitner, S. Dustdar, WS-aggregation: distributed aggregation of web services data, in: ACM Symposium On Applied Computing (SAC), 2011.
43. J. Crampton, A reference monitor for workflow systems with constrained task execution, in: 10th ACM Symposium on Access Control Models and Technologies (SACMAT), 2005, pp. 38-47.
44. J. Crampton, G. Gutin, and A. Yeo On the parameterized complexity of the workflow satisfiability problem 19th ACM Conference on Computer and Communications Security (CCS) 2012 ACM 857 868
45. Q. Wang, and N. Li Satisfiability and resiliency in workflow authorization systems ACM Transactions on Information and System Security (TISSEC) 13 4 2010 40:1 40:35
46. S. Schefer, M. Strembeck, J. Mendling, and A. Baumgrass Detecting and resolving conflicts of mutual-exclusion and binding constraints in a business process context 19th International Conference on Cooperative Information Systems (CoopIS'11) 2011 Springer
47. S. Schefer, M. Strembeck, and J. Mendling Checking satisfiability aspects of binding constraints in a business process context Workshop on Workflow Security Audit and Certification (WfSAC) 2011 Springer
48. A. Ferreira, R. Cruz-Correia, L. Antunes, P. Farinha, E. Oliveira-Palhares, D. Chadwick, A. Costa-Pereira, How to break access control in a controlled manner, in: 19th IEEE International Symposium on Computer-Based Medical Systems (CBMS), 2006, pp. 847-854.
49. S. Marinovic, R. Craven, J. Ma, N. Dulay, Rumpole: a flexible break-glass access control model, in: 16th ACM Symposium on Access Control Models and Technologies (SACMAT), 2011.
50. S. Schefer-Wenzl, M. Strembeck, A UML extension for modeling break-glass policies, in: 5th International Workshop on Enterprise Modelling and Information Systems Architectures (EMISA), 2012.
51. A. Baumgrass, T. Baier, J. Mendling, and M. Strembeck Conformance checking of RBAC policies in process-aware information systems BPM'11 Workshop on Workflow Security Audit and Certification (WfSAC) 2011 Springer
52. World Wide Web Consortium (W3C), XML Signature Syntax and Processing, 2008 < http://www.w3.org/TR/xmldsig-core/ >.
53. M. Jensen, S. Feja, A security modeling approach for web-service-based business processes, in: 16th Annual IEEE International Conference on the Engineering of Computer Based Systems (ECBS'09), 2009, pp. 340-347.
54. A.-W. Scheer, O. Thomas, and O. Adam Process Modeling using Event-Driven Process Chains 2005 John Wiley & Sons, Inc. pp. 119-145
55. OASIS, WS-SecurityPolicy 1.3, 2009 < http://docs.oasis-open.org/ws-sx/ ws-securitypolicy/v1.3/os/ >.
56. D. Kulkarni, A. Tripathi, Context-aware role-based access control in pervasive computing systems, in: 13th ACM Symposium on Access Control Models and Technologies (SACMAT), 2008, pp. 113-122.
57. M. Strembeck, and G. Neumann An integrated approach to engineer and enforce context constraints in RBAC environments ACM Transactions on Information and System Security 7 3 2004 392 427
58. N. Dimmock, A. Belokosztolszki, D. Eyers, J. Bacon, K. Moody, Using trust and risk in role-based access control policies, in: 9th ACM Symposium on Access Control Models and Technologies (SACMAT), 2004.
59. H. Skogsrud, B. Benatallah, and F. Casati Model-driven trust negotiation for web services IEEE Internet Computing 7 2003 45 52
60. H. Foster, S. Uchitel, J. Magee, and J. Kramer An integrated workbench for model-based engineering of service compositions IEEE Transactions on Services Computing 3 2 2010 131 144
61. D. Fensel, and C. Bussler The web service modeling framework WSMF Electronic Commerce Research and Applications 1 2 2002 113 137
62. S. McIlraith, T. Son, and H. Zeng Semantic web services IEEE Intelligent Systems 16 2 2001 46 53
63. S. Smirnov, H.A. Reijers, M. Weske, A semantic approach for business process model abstraction, in: 23rd International Conference on Advanced Information Systems Engineering (CAiSE), 2011, pp. 497-511.
64. M. Memon, M. Hafner, R. Breu, SECTISSIMO: A Platform-independent Framework for Security Services, in: Modeling Security Workshop at MODELS '08, 2008.
65. D. Lin, P. Rao, E. Bertino, N. Li, J. Lobo, Policy decomposition for collaborative access control, in: 13th ACM SACMAT, 2008, pp. 103-112.
66. D. Basin, J. Doser, and T. Lodderstedt Model driven security: from UML models to access control infrastructures ACM Transactions on Software Engineering Methodology 15 2006 39 91
67. F. Paci, E. Bertino, and J. Crampton An access-control framework for WS-BPEL International Journal of Web Services Research 5 3 2008 20 43
68. OASIS, eXtensible Access Control Markup Language, 2005 < http://docs.oasis-open.org/xacml/2.0 >.
69. P. Mazzoleni, B. Crispo, S. Sivasubramanian, and E. Bertino XACML policy integration algorithms ACM Transactions on Information and System Security 11 2008 4:1 4:29
70. K. Czarnecki, and S. Helsen Feature-based survey of model transformation approaches IBM Systems Journal - Model-Driven Software Development 45 2006 621 645
71. G. Kiczales, J. Lamping, A. Mendhekar, C. Maeda, C. Lopes, J.-M. Loingtier, J. Irwin, Aspect-oriented programming, in: European Conference on Object-Oriented Programming (ECOOP'97), 1997, pp. 220-242.
72. A. Mourad, S. Ayoubi, H. Yahyaoui, H. Otrok, New approach for the dynamic enforcement of Web services security, in: 8th International Conference on Privacy Security and Trust, 2010, pp. 189-196.
73. A. Charfi, and M. Mezini AO4BPEL: an aspect-oriented extension to BPEL World Wide Web Journal - Special Issue: Recent Advances in Web Services 10 2007 309 344
74. C. Braga A transformation contract to generate aspects from access control policies Software and Systems Modeling 10 2011 395 409
75. T. Lodderstedt, D.A. Basin, and J. Doser Secureuml: a uml-based modeling language for model-driven security 5th International Conference on The Unified Modeling Language (UML'02) 2002 Springer Verlag 426 441
76. W. Sadiq, and M. Orlowska On business process model transformations 19th International Conference on Conceptual Modeling 2000 Springer Berlin/Heidelberg 267 280
77. J. Eder, and W. Gruber A meta model for structured workflows supporting workflow transformations 6th East European Conference on Advances in Databases and Information Systems (ADBIS'02) 2002 Springer-Verlag 326 339
78. W. Hummer, O. Raz, O. Shehory, P. Leitner, S. Dustdar, Test coverage of data-centric dynamic compositions in service-based systems, in: 4th International Conference on Software Testing, Verification and Validation (ICST), 2011, pp. 40-49.
79. C. Inzinger, W. Hummer, B. Satzger, P. Leitner, S. Dustdar, Identifying incompatible service implementations using pooled decision trees, in: 28th ACM Symposium on Applied Computing (SAC), 2013, pp. 485-492.
80. B. Weber, M. Reichert, W. Wild, and S. Rinderle Balancing flexibility and security in adaptive process management systems On the Move to Meaningful Internet Systems 2005: CoopIS, DOA, and ODBASE vol. 3760 2005 Springer Berlin/Heidelberg 59 76
81. M. Schäfer, P. Dolog, and W. Nejdl An environment for flexible advanced compensations of web service transactions ACM Transactions on the Web 2 2 2008 14:1 14:36
82. M. von Riegen, M. Husemann, S. Fink, and N. Ritter Rule-based coordination of distributed web service transactions IEEE Transactions on Services Computing 3 1 2010 60 72
83. B. Benatallah, F. Casati, and F. Toumani Web service conversation modeling: a cornerstone for e-business automation IEEE Internet Computing 8 1 2004 46 54
84. W. Hummer, C. Inzinger, P. Leitner, B. Satzger, S. Dustdar, Deriving a unified fault taxonomy for event-based systems, in: 6th ACM International Conference on Distributed Event-Based Systems (DEBS'12), 2012.
85. P. Gaubatz, U. Zdun, Supporting entailment constraints in the context of collaborative web applications, in: 28th Symposium on Applied Computing (SAC), ACM, 2013.
86. P. Gaubatz, W. Hummer, U. Zdun, and M. Strembeck Supporting customized views for enforcing access control constraints in real-time collaborative web applications 13th International Conference on Web Engineering (ICWE) 2013 Springer