Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

Enforcing ASTD Access-Control Policies with WS-BPEL Processes in SOA Environments

Michel Embe Jiague (Université de Sherbrooke, Canada and Université Paris-Est Créteil Val-de-Marne, France), Marc Frappier (Université de Sherbrooke, Canada), Frédéric Gervais (Université Paris-Est Créteil Val-de-Marne, France), Régine Laleau (Université Paris-Est Créteil Val-de-Marne, France) and Richard St-Denis (Université de Sherbrooke, Canada)
DOI: 10.4018/jssoe.2011040103
OnDemand PDF Download:
$30.00
List Price: $37.50

Abstract

Controlling access to the Web services of public agencies and private corporations depends primarily on specifying and deploying functional security rules to satisfy strict regulations imposed by governments, particularly in the financial and health sectors. This paper focuses on one aspect of the SELKIS and EB3SEC projects related to the security of Web-based information systems, namely, the automatic transformation of security rules into WS-BPEL (or BPEL, for short) processes. The former are instantiated from security-rule patterns written in a graphical notation, called ASTD that is close to statecharts. The latter are executed by a BPEL engine integrated into a policy decision point, which is a component of a policy enforcement manager similar to that proposed in the XACML standard.
Article Preview

Expressing Security Rules With An Astd

In most security frameworks, a security policy is a combination of many security rules. Researchers and security practitioners (Basin, Burri, & Karjoth, 2009; Konopacki, Frappier, & Laleau, 2010a, 2010b; Yao, Moody, & Bacon, 2001) have considered the following categories for security rules:

  • Permission which authorizes actions to be executed;

  • Prohibition which forbids actions to be executed;

  • Separation of duty which expresses the fact that a set of tasks cannot be executed by the same users or roles;

  • Obligation which forces a user to perform an action sometime in the future after he has performed a specific action. In other words, two distinct actions must be performed by the same user.

Complete Article List

Search this Journal:
Reset
Open Access Articles: Forthcoming
Volume 7: 4 Issues (2017): 2 Released, 2 Forthcoming
Volume 6: 4 Issues (2016)
Volume 5: 4 Issues (2015)
Volume 4: 4 Issues (2014)
Volume 3: 4 Issues (2012)
Volume 2: 4 Issues (2011)
Volume 1: 4 Issues (2010)
View Complete Journal Contents Listing