From Business Process Choreography to Authorization Policies

Robinson, Philip; Kerschbaum, Florian; Schaad, Andreas

doi:10.1007/11805588_21

Cited by 13 publications

(9 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our policy derivation algorithm [20] uses the control flow of the choreography in order to minimize the time a policy is enabled. In addition to extracting only the relevant <InterAction> elements and enabling them over the lifetime of the choreography, we also use the control-flow of the choreography to trigger the enabling and disabling of the policies.…”

Section: Control-flow Aware Authorization Policy Derivationmentioning

confidence: 99%

“…The paper proceeds to describe related work towards addressing these requirements in Section 2, proposes an architecture in Section 3 and describes two main features of the architecture in detail in Sections 4 and 5 respectively: control-flow aware authorization policy derivation, which builds on previous work in [20]) and secure VO management, which builds on previous work in [5,14].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Security architecture for virtual organizations of business web services

Kerschbaum¹,

Robinson

2009

Journal of Systems Architecture

Self Cite

View full text Add to dashboard Cite

Virtual Organizations (VO) temporarily aggregate resources of different domains to achieve a common goal. Web services are being positioned as the technological framework for achieving this aggregation in the context of cross-organizational business applications. Numerous architectures have been proposed for securing VOs, mostly for scientific research, such that they do not address all the requirements of business-oriented applications. This paper describes these additional requirements and proposes a novel architecture and approach to managing VO access control policies. Business users can focus on designing business processes, exposing web services and managing their VO partnerships, while the architecture supports and secures the web service interactions involved.

show abstract

Section: Control-flow Aware Authorization Policy Derivationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Security architecture for virtual organizations of business web services

Kerschbaum¹,

Robinson

2009

Journal of Systems Architecture

Self Cite

View full text Add to dashboard Cite

show abstract

“…AC for service compositions within a single trust domain Robinson et al (2006) present an approach to "automatically derive the minimal authorizations required for collaboration, as well as enable and disable the authorizations in a just-in-time manner that matches the control flow described in the choreography." They use it for "runtime management of authorization policies" of ad-hoc combined web-service, but the basic idea could be utilized as building block in the approach described in this article.…”

Section: Related Workmentioning

confidence: 99%

Delegation of access rights in multi-domain service compositions

Bussard

Nano

Pinsdorf

2009

IDIS

View full text Add to dashboard Cite

Today, it becomes more and more common to combine services from different providers into one application. Service composition is however difficult and cumbersome when there is no common trust anchor. Hence, delegation of access rights across trust domains will become essential in service composition scenarios. This article specifies abstract delegation, discusses theoretical aspects of the concept, and provides technical details of a validation implementation supporting a variety of access controls and associated delegation mechanisms. Abstract delegation allows to harmonize the management of heterogeneous access control mechanisms and to offer a unified user experience. The authors observe standardization efforts to reduce application and domainspecific delegation mechanisms, but this variety is very unlikely to completely disappear.

show abstract

“…Reputation systems have often been proposed to support Virtual Organizations (VO) formation [3,18,28,34]. A common problem that arises in these and other reputation systems is that the evaluated parties exert pressure to suppress negative ratings.…”

Section: Introductionmentioning

confidence: 99%

“…party is to threaten with negative ratings in return for negative ratings. It does not even have to be case that the reputation system accepts only mutual ratings, but as in the case of VO formation [34] where all parties are raters and ratees, one can retaliate in a seemingly unrelated transaction. The solution presented in this paper is to protect the privacy of the ratings, i.e.…”

Section: Introductionmentioning

confidence: 99%

A verifiable, centralized, coercion-free reputation system

Kerschbaum¹

2009

Proceedings of the 8th ACM Workshop on Privacy in the Electronic Society

Self Cite

View full text Add to dashboard Cite

Reputation systems are popular tools to evaluate the trustworthiness of an unknown party before a transaction, but the reputation score can greatly impact the rated subject, such that it might be inclined to suppress negative ratings. In order to elicit coercion-resistant, honest feedback, this paper proposes a reputation system that provides complete privacy of the ratings, i.e. neither the ratee nor the reputation system will learn the value of the rating. We take both, a cryptographic as well as a non-cryptographic approach, to the problem. Privacy of ratings may foster bad mouthing attacks where an attacker leaves intentionally bad feedback. We limit the possibility for this attack by providing a token system such that one can only leave feedback after a transaction, and provide a cryptographic proof of the privacy of our system. We consider the Virtual Organization formation problem and develop and evaluate a novel reputation aggregation algorithm for it.

show abstract

From Business Process Choreography to Authorization Policies

Cited by 13 publications

References 13 publications

Security architecture for virtual organizations of business web services

Security architecture for virtual organizations of business web services

Delegation of access rights in multi-domain service compositions

A verifiable, centralized, coercion-free reputation system

Contact Info

Product

Resources

About