Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

Expressing Security Rules With An Astd

In most security frameworks, a security policy is a combination of many security rules. Researchers and security practitioners (Basin, Burri, & Karjoth, 2009; Konopacki, Frappier, & Laleau, 2010a, 2010b; Yao, Moody, & Bacon, 2001) have considered the following categories for security rules:

• •

  Permission which authorizes actions to be executed;

• •

  Prohibition which forbids actions to be executed;

• •

  Separation of duty which expresses the fact that a set of tasks cannot be executed by the same users or roles;

• •

  Obligation which forces a user to perform an action sometime in the future after he has performed a specific action. In other words, two distinct actions must be performed by the same user.