组合Web服务业务流程访问控制技术研究综述

doi:10.11896/j.issn.1002-137X.2015.07.021

摘要/Abstract

摘要： 业务流程访问控制是保证组合Web服务增值安全应用的关键技术,着重论述了组合Web服务业务流程访问控制技术的研究现状及问题。首先对组合Web服务业务流程安全需求进行了分析,然后从组合Web服务业务流程访问控制模型、业务流程运行时访问授权约束、业务流程协同访问授权的一致性检验3个方面分析了业务流程访问控制核心技术的研究进展。最后,结合已有的研究成果,指出了目前研究的挑战以及未来的发展趋势。

关键词: 组合Web服务,业务流程,访问控制

Abstract: Access control of business process is one of the key technologies in secure and reliable Web services composition value-added application.This paper briefly reviewed the state of the research for access control of business process in Web services composition.We firstly analyzed the security problems concerning business process.Then,we discussed the research progress on the key access control technology from three respects of access control model of composite Web services business process,authorization constraint of business process in run-time and consistency detection in authorization coordination.Finally,the discussion of future directions and challenges was presented.

Key words: Composite Web services,Business process,Access control

上超望,刘清堂,王艳凤. 组合Web服务业务流程访问控制技术研究综述[J]. 计算机科学, 2015, 42(7): 99-102. https://doi.org/10.11896/j.issn.1002-137X.2015.07.021

SHANG Chao-wang, LIU Qing-tang and WANG Yan-feng. Survey on Access Control Technology of Composite Web Services Business Process[J]. Computer Science, 2015, 42(7): 99-102. https://doi.org/10.11896/j.issn.1002-137X.2015.07.021

参考文献

[1] 林日昶,赵文耘,等.支持风险偏好的Web服务动态组合方法[J].中国科学:信息科学,2014,4(1):130-141 Lin Ri-chang,Zhao Wen-yun,et al.Dynamic Web service composition approach supporting different risk appetites[J].Scientia Sinica Information,2014,4(1):130-141
[2] 余波.应用Petri网改进BPEL程序的正确性[J].计算机应用研究,2011,8(9):3348-3352 Yu Bo.Improving correctness of BPEL program with petri net[J].Application Research of Computers,2011,28(9):3348-3352
[3] Kristof G.Adaptive workflow composition in service -based systems[D].Leuven:Katholieke university,2013 Yu Bo.Improving Correctness of BEPL Program with Petri net[J].Application Research of Computers,2011,8(9):3348-3352
[4] Roman K.Provision of service level agreements in human-enhanced service-oriented computing environments[D].Vienna:Vienna University of Technology,2012
[5] Henrique J A,Jose J M.Performance evaluation of web services orchestrated with WS-BPEL4 People[J].International Journal of Computer Networks & Communications,2010,2(6):117-134
[6] Huy T,Uwe Z,et al.Compliance in service-oriented architectures:a model-driven and view-based approach[J].Information and Software Technology,2013,4(5):531-552
[7] Waldemar H,Patrick G,et al.An integrated approach for identity and access management in a soa context[C]∥The ACM Symposium on Access Control Models and Technologies.2011:21-30
[8] Anupa B,Prasanna N B.Intelligent compliance certification[J].International Journal of Advanced Computer and Mathematical Sciences,2012,3(4):394-404
[9] Emmanouela S,Anakreon M,et al.Rigorous analysis of service composability by embedding WS-BPEL into the BIP component framework[C]∥Proc of 19th International Conference on Web Services.2012:319-326
[10] Karsten T.A Unified framework for security visualization and enforcement in business process driven environments[D].Stuttgart:University of Stuttgart,2011
[11] Leitner M,Rinderle M,et al.AW-RBAC:access control in adaptive workflow systems[C]∥Proc of 6th International Confe-rence on Availability.Reliability and Security,2011:27-34
[12] Jakob G.Team execution of multi-user workflows -modeling,dependability and optimization[D].Munich:Technique University of Munich,2009
[13] Wang Xin.A framework to manage message level authorization in service oriented collaborative business processes[D].Melbourne:Victoria University,2013
[14] Thomas R K,Sandahu R.Task-based authentication controls(TABC):a family of models for active and enterprise-oriented authentication management[C]∥Proc of IFIP Workshop on Database Security.1997:165-172
[15] Han R F,et al.A united access control model for systems collaborative commerce[J].Journal of Networks,2009,4(4):279-290
[16] Yu Ding-guo.Role and task-based access control model for Web service integration[J].Journal of Computational Information Systems,2012,8(7):2681-2689
[17] Rajender N,Gulshan A.An authorization mechanism for access control of resources in the web services paradigm[J].International Journal of Advanced Computer Science and Applications,2011,2(6):36-43
[18] Mark S,Jan M.Modeling process-related RBAC models with ex-tended UML activity models[J].Information and Software Technology,2011,53(2):456-483
[19] Ganna M,Brucker A D,et al.Security and safety of assets in business processes[C]∥Proc of the 27th Symposium on Applied Computing.2013:1667-1673
[20] Doglas R,Estrella J C,et al.Analysis of security and perfor-mance aspects in service-oriented architectures[J].International Journal of Security and Its Applications,2011,5(1):13-30
[21] 魏永合.工作流环境下访问控制技术研究[D].沈阳:东北大学,2009 We Yong-he.Research on Technology of Access Control under Workflow[D].Shenyang:Northeastern University,2009
[22] Samuel J B.Modeling and enforcing workflow authorizations[D].Zurich:Eth Zurich,2012
[23] David B,Samuel J B,et al.Separation of duties as a service[C]∥Proc of the 6th ACM Symposium on Information,Computer and Communications Security.2013:423-429
[24] Bernhand H,Stefan S,et al.Modeling and enforcing secure object flows in process-driven SOAs:an integrated model-driven approach[J].Software and Systems Modeling,2012,5(2):1-36
[25] Frederica P,Bertino E.An access-control framework for WS-BPEL [J].International Journal of Web Services Research,2008,5(3):20-43
[26] 上超望,刘清堂,等.使用控制支持的组合Web服务业务流程动态访问控制模型研究[J].武汉大学学报(理学版),2011,7(5):408-412 Shang Chao-wang,Liu Qing-tang,et al.A Research on UCON Enhanced Dynamic Access Control Model for the Business Process of Composite Web Services[J].Journal of Wuhan University(Natural Science Edition),2011,7(5):408-412
[27] Rafael A.An approach to data-driven detective internal controls for process-aware information Systems[C]∥Workshop on Data Usage Management on the Web 2012.2012:20-25
[28] Bertino E,Martino D L,et al.Security for Web services and ser-vice-oriented architectures[M].Berlin:Springer,2010:170-175
[29] Ahmed A.A compliance management framework for BusinessProcess models[D].Potsdam:University Of Potsdam,2010
[30] Mohsen R.Security analysis for web services compositions [J].International Journal of Scientific & Engineering Research,2012, 3(5):1-8
[31] Alberto C,Silvio R,et al.Automated validation of security-sensitive Web Services specified in BPEL and RBAC[C]∥Proc of the 12th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing.2010:456-464
[32] Maria L,Juergen M,et al.SPRINT-responsibilities:design and development of security policies in process-aware information systems[J].Journal of Wireless Mobile Networks,Ubiquitous Computing,and Dependable Applications,2011,2(4):4-26
[33] Manuel M,Nicola D.Implementing workflow reconfiguration in WS-BPEL[J].Journal of Internet Services and Information Security,2013,2(2):73-92
[34] 许蕾,徐宝文,等.一种面向用户需求的Web服务测试方法[J].计算机学报,2014,7(3):512-522 Xu Lei,Xu Bao-wen, et al.A Testing Method for Web Services Focusing on User Requirement[J].Chinese Journal of Computers,2014,7(3):512-522
[35] Michel E J,Marc F,et al.Enforcing ASTD access-control policies with WS-BPEL processes in soa environments[J].International Journal of Systems and Service-Oriented Engineering,2011,2(2):37-59
[36] Ziyi S.Applying digital rights management to corporate information systems[D].Lyon:National Institute of Applied Sciences,2012
[37] Hristo K.A Survey on distributed access control systems for Web business processes[J].International Journal of Network Security,2009,9(1):61-69
[38] Fernando L,Julio D,et al.Towards automation of soa-basedBusiness Process[J].International Journal of Computer Science,Engineering and Applications,2012,2(2):1-17
[39] Alfonso R,Eduardo F,et al.Secure business process model speci-fication through a UML 2.0 activity diagram profile[J].Decision Support Systems,2011,1(6):446-465
[40] Zahra D,Behrouz T L.A model for specification,compositionand verification of access control policies and its application to Web services[J].Journal of Information Security,2013,3(2):103-120

Metrics

Viewed

Full text

Abstract

Cited

Shared

Discussed