xESB: An Enterprise Service Bus for Access and Usage Control Policy Enforcement

Abstract

Enforcing complex policies that span organizational domains is an open challenge. Current work on SOA policy enforcement splits security in logical components that can be distributed across domains, but does not offer any concrete solution to integrate this security functionality so that it works across security services for organization-wide policies. In this paper, we propose xESB, an enhanced version of an Enterprise Message Bus (ESB), where we monitor and enforce preventive and reactive policies, both for access control and usage control policies, and both inside one domain and between domains. In addition, we introduce indicators that help SOA administrators assess the effectiveness of their policies. Our performance measurements show that policy enforcement at the ESB level comes with only moderate penalties.

On the Dependability of Highly Heterogeneous and Open Distributed Systems

“…Considerable research effort has been devoted to SFT, mostly, but not exclusively, for local Journal of Software Engineering and Applications (non-distributed) systems. See [31] for a survey. According to this research, SFT-measures are to be established by incorporating failure-handling code (henceforth "SFT-code") into the code of the original software; which may have to be done, systematically, in many parts of the system.…”

Representation-Independent Data Usage Control

“…Enforcement of usage control requirements has been done at the OS level [26,27,3], at the X11 level [4], for Java [11,12,28], the .NET CIL [13] and machine languages [14,15,29]; at the level of an enterprise service bus [16]; for dedicated applications such as the Internet Explorer [17] and in the context of digital rights management [18][19][20]. These solutions focus on one of the two aspects of the problem: either data flow tracking or event-driven usage control.…”

“…opened, (lines 12-15) at most 4 further times and within 30 seconds (1 timestep = 1 second) after the first use (lines [8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27]; further attempts of opening the file will result in opening a predefined error message (lines 28-34).…”

“…We do not discuss performance nor policy management either. Contribution Data flow tracking at specific layers of abstraction has been done in a multitude of ways [3,4,[11][12][13][14][15][16][17][18][19][20], also in the form of information flow analyses where implicit flows are also taken into account [21,22]. As far as we are aware, this work ends where sensitive (or tainted) data is moved to illegal sinks, e.g., when a file is written or an http post request is sent.…”

“…</ e x e c u t e> 19 </ a c t i o n s> 20 </ c o n t r o l M e c h a n i s m> 21 22 <c o n t r o l M e c h a n i s m> 23 <i d>B r o w s e r C l i p</ i d> 24 <t r i g g e r E v e n t> 25 <i d>c o p y e x t</ i d> 26 <p a r a m e t e r name=" o b j " v a l u e=" l b l a d d r e s s " t y p e=" d ataUsage " /> 27 <p a r a m e t e r name=" i s T r y " v a l u e=" t r u e " /> 28 </ t r i g g e r E v e n t> 29 <c o n d i t i o n> 30 <t r u e /> 31 </ c o n d i t i o n> 32 <a c t i o n s> 33 < i n h i b i t /> 34 </ a c t i o n s> 35 </ c o n t r o l M e c h a n i s m> With these two mechanisms, a notification is sent to the (social network) user (lines [14][15][16][17] if the content of the address field on its profile page (line 5) is sent as a part of a submission form (lines 3-7) (e.g., when posted on a bulletin board or sent using a webmail client like Gmail) and cannot be copied to the system clipboard (lines [24][25][26][27][28]33).…”