Using information flow analysis to detect implicit information leaks for web service composition

Jia-xin JIANG; Zhi-qiu HUANG; Wei-wei MA; Yan CAO

doi:10.1631/FITEE.1601371

Your Location：

Home >

Browse articles >

Using information flow analysis to detect implicit information leaks for web service composition

Regular Papers | Updated：2022-05-19

- Using information flow analysis to detect implicit information leaks for web service composition
- 使用信息流分析检测Web服务组合隐性信息泄露
- Frontiers of Information Technology & Electronic Engineering Vol. 19, Issue 4, Pages: 494-502(2018)
- Affiliations：
  
  College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 210016, China
  Collaborative Innovation Center of Novel Software Technology and Industrialization, Nanjing 210000, China
- Author bio：
  
  Jia-xin JIANG, E-mail: jiangjiaxin@nuaa.edu.cn
  [ "Zhi-qiu HUANG, E-mail: zqhuang@nuaa.edu.cn" ]
  [ "Wei-wei MA, E-mail: maweiwei@nuaa.edu.cn" ]
  [ "Yan CAO, E-mail: caoyan926@nuaa.edu.cn" ]
- Funds：
- DOI：10.1631/FITEE.1601371
  CLC： TP311
- Received：24 June 2016，
  
  Revised：2018-;4-;4，
  
  Published：2018-04
- Accepted：
Scan QR Code
Jia-xin JIANG, Zhi-qiu HUANG, Wei-wei MA, et al. Using information flow analysis to detect implicit information leaks for web service composition[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(4): 494-502.
DOI：

Jia-xin JIANG, Zhi-qiu HUANG, Wei-wei MA, et al. Using information flow analysis to detect implicit information leaks for web service composition[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(4): 494-502. DOI： 10.1631/FITEE.1601371.

摘要

信息泄露会破坏Web服务组合业务流程对某些策略的遵从性，是Web服务组合中的一个主要问题。提出一种基于信息流分析的有效的自动化方法用于检测业务流程执行语言（BPEL）中的隐性信息泄露。引入Petri网元模型对BPEL进行转换和分析。以Petri网中基于库所的无干扰性概念为基础，使用Petri网可达图分析Petri网干扰性，检测Web服务组合中的隐性信息泄露，并通过一个案例说明该方法在具体BPEL工作流中的应用。

Abstract

Information leak

which can undermine the compliance of web-service-composition business processes for some policies

is one of the major concerns in web service composition. We present an automated and effective approach for the detection of implicit information leaks in business process execution language (BPEL) based on information flow analysis. We introduce an adequate meta-model for BPEL representation based on a Petri net for transformation and analysis. Building on the concept of Petri net place-based noninterference

the core contribution of this paper is the application of a Petri net reachability graph to estimate Petri net interference and thereby to detect implicit information leaks in web service composition. In addition

a case study illustrates the application of the approach on a concrete workflow in BPEL notation.

关键词

Keywords

references

R Accorsi , , , C Wonnemann . . Detective information flow analysis for business processes . . Int Conf on Business Process, Services Computing, and Intelligent Service Management , , 2009 . . p.223 - - 224 . . . .

R Accorsi , , , C Wonnemann . . Static information flow analysis of workflow models . . Int Conf on Business Process and Service Science , , 2010 . . p.194 - - 205 . . . .

R Accorsi , , , A Lehmann , , , N Lohmann . . Information leak detection in business process models: theory, application, and tool support . . Inform Syst , , 2015 . . 47 244 - - 257 . . DOI: 10.1016/j.is.2013.12.006 http://doi.org/10.1016/j.is.2013.12.006 . .

F Ahmad , , , H Huang , , , X Wang . . Petri net modeling and deadlock analysis of parallel manufacturing processes with shared-resources . . J Syst Softw , , 2010 . . 83 ( ( 4 ): ): 675 - - 688 . . DOI: 10.1016/j.jss.2009.11.705 http://doi.org/10.1016/j.jss.2009.11.705 . .

A Armando , , , S Ranise . . Automated analysis of infinite state workflows with access control policies . . 7 th Int Workshop on Security and Trust Management , , 2011 . . p.157 - - 174 . . DOI: 10.1007/978-3-642-29963-6_12 http://doi.org/10.1007/978-3-642-29963-6_12 . .

V Atluri . . Security for workflow systems . . Inform Secur Technol Rep , , 2001 . . 6 ( ( 2 ): ): 59 - - 68 . . DOI: 10.1016/S1363-4127(01)00207-2 http://doi.org/10.1016/S1363-4127(01)00207-2 . .

V Atluri , , , S Chun , , , P Mazzoleni . . A Chinese wall security model for decentralized workflow systems . . 8 th ACM Conf on Computer and Communications Security , , 2001 . . p.48 - - 57 . . DOI: 10.1145/501983.501991 http://doi.org/10.1145/501983.501991 . .

K Barkaoui , , , R Ayed , , , H Boucheneb , , , 等 . . Verification of workflow processes under multilevel security considerations . . 3 rd Int Conf on Risks and Security of Internet and Systems , , 2008 . . p.77 - - 84 . . DOI: 10.1109/CRISIS.2008.4757466 http://doi.org/10.1109/CRISIS.2008.4757466 . .

D Bell . . Secure computer systems: a retrospective . . IEEE Symp on Security and Privacy , , 1983 . . p.161 - - 162 . . DOI: 10.1109/SP.1983.10001 http://doi.org/10.1109/SP.1983.10001 . .

D Bell , , , L LaPadula . . Secure Computer Systems: Mathematical Foundations and Model . . DTIC Document , , 1973 . . .

B Benatallah , , , M Dumas , , , Z Maamar . . Definition and execution of composite web services: the self-serv project . . IEEE Data Eng Bull , , 2002 . . 25 ( ( 4 ): ): 47 - - 52 . . http://sites.computer.org/debull/A02DEC-CD.pdf http://sites.computer.org/debull/A02DEC-CD.pdf , , . .

N Busi , , , R Gorrieri . . A survey on noninterference with Petri nets , , : : ACPN Lectures on Concurrency and Petri Nets , , 2003 . . p.328 - - 344 . . . .

N Busi , , , R Gorrieri . . Structural noninterference in elementary and trace nets . . Math Struct Comput Sci , , 2009 . . 19 ( ( 6 ): ): 1065 - - 1090 . . DOI: 10.1017/S0960129509990120 http://doi.org/10.1017/S0960129509990120 . .

B Carminati , , , E Ferrari , , , P Hung . . Exploring privacy issues in web services discovery agencies . . IEEE Secur Priv , , 2005 . . 3 ( ( 5 ): ): 14 - - 21 . . DOI: 10.1109/MSP.2005.121 http://doi.org/10.1109/MSP.2005.121 . .

D Denning . . A lattice model of secure information flow . . Commun ACM , , 1976 . . 19 ( ( 5 ): ): 236 - - 243 . . DOI: 10.1145/360051.360056 http://doi.org/10.1145/360051.360056 . .

J Goguen , , , J Meseguer . . Security policies and security models . . IEEE Symp on Security and Privacy , , 1982 . . p.11 - - 20 . . DOI: 10.1109/SP.1982.10014 http://doi.org/10.1109/SP.1982.10014 . .

K Hui , , , B Tan , , , C Goh . . Online information disclosure: motivators and measurements . . ACM Trans Intern Technol , , 2006 . . 6 ( ( 4 ): ): 415 - - 441 . . DOI: 10.1145/1183463.1183467 http://doi.org/10.1145/1183463.1183467 . .

K Juszczyszyn . . Verifying enterprise's mandatory access control policies with colored Petri nets . . 12 th IEEE Int Workshops on Enabling Technologies , , 2003 . . p.184 - - 189 . . DOI: 10.1109/ENABL.2003.1231405 http://doi.org/10.1109/ENABL.2003.1231405 . .

L Kagal , , , M Paolucci , , , N Srinivasan , , , 等 . . Authorization and privacy for semantic web services . . IEEE Intell Syst , , 2004 . . 19 ( ( 4 ): ): 50 - - 56 . . DOI: 10.1109/MIS.2004.23 http://doi.org/10.1109/MIS.2004.23 . .

B Lampson . . A note on the confinement problem . . Commun ACM , , 1973 . . 16 ( ( 10 ): ): 613 - - 615 . . DOI: 10.1145/362375.362389 http://doi.org/10.1145/362375.362389 . .

N Lohmann , , , P Massuthe , , , C Stahl , , , 等 . . Analyzing interacting BPEL processes . . 4 th Int Conf on Business Process Management , , 2006 . . p.17 - - 32 . . DOI: 10.1007/11841760_3 http://doi.org/10.1007/11841760_3 . .

N Lohmann , , , E Verbeek , , , R Dijkman . . Petri net transformations for business processes-a survey . . Trans Petri Nets Other Models Concurr , , 2009 . . 2 46 - - 63 . . DOI: 10.1007/978-3-642-00899-3_3 http://doi.org/10.1007/978-3-642-00899-3_3 . .

Y Lu , , , L Zhang , , , J Sun . . Using colored Petri nets to model and analyze workflow with separation of duty constraints . . Int J Adv Manuf Technol , , 2009 . . 40 ( ( 1-2 ): ): 179 - - 192 . . DOI: 10.1007/s00170-007-1316-1 http://doi.org/10.1007/s00170-007-1316-1 . .

F Massacci , , , J Mylopoulos , , , N Zannone . . Hierarchical hippocratic databases with minimal disclosure for virtual organizations . . VLDB J , , 2006 . . 15 ( ( 4 ): ): 370 - - 387 . . DOI: 10.1007/s00778-006-0009-y http://doi.org/10.1007/s00778-006-0009-y . .

A Myers , , , B Liskov . . A decentralized model for information flow control . . 16 th ACM Symp on Operating System Principles , , 1997 . . p.129 - - 142 . . DOI: 10.1145/268998.266669 http://doi.org/10.1145/268998.266669 . .

M Papazoglou . . Cloud blueprint: a model-driven approach to configuring federated clouds . . 2 nd Int Conf on Model and Data Engineering , , 2012 . . p.1 DOI: 10.1007/978-3-642-33609-6_1 http://doi.org/10.1007/978-3-642-33609-6_1 . .

S Rhrig , , , K Knorr . . Security analysis of electronic business processes . . Electron Commerce Res , , 2004 . . 4 ( ( 1-2 ): ): 59 - - 81 . . DOI: 10.1023/B:ELEC.0000009282.06809.c5 http://doi.org/10.1023/B:ELEC.0000009282.06809.c5 . .

A Sabelfeld , , , A Myers . . Language-based informationflow security . . IEEE J Sel Areas Commun , , 2003 . . 21 ( ( 1 ): ): 5 - - 19 . . DOI: 10.1109/JSAC.2002.806121 http://doi.org/10.1109/JSAC.2002.806121 . .

B Shafiq , , , A Masood , , , J Joshi , , , 等 . . A role-based access control policy verification framework for real-time systems . . 10 th IEEE Int Workshop on Object-Oriented Real-Time Dependable Systems , , 2005 . . p.13 - - 20 . . DOI: 10.1109/WORDS.2005.11 http://doi.org/10.1109/WORDS.2005.11 . .

M Singh . . Being interactive: physics of service composition . . IEEE Intern Comput , , 2001 . . 5 ( ( 3 ): ): 6 - - 7 . . . .

H Sun , , , X Wang , , , J Yang , , , 等 . . Authorization policy based business collaboration reliability verification . . 6 th Int Conf on Service-Oriented Computing , , 2008 . . p.579 - - 584 . . DOI: 10.1007/978-3-540-89652-4_49 http://doi.org/10.1007/978-3-540-89652-4_49 . .

W Tan , , , Y Fan , , , M Zhou . . A Petri net-based method for compatibility analysis and composition of web services in business process execution language . . IEEE Trans Autom Sci Eng , , 2009 . . 6 ( ( 1 ): ): 94 - - 106 . . DOI: 10.1109/TASE.2008.916747 http://doi.org/10.1109/TASE.2008.916747 . .

S Tbahriti , , , C Ghedira , , , B Medjahed , , , 等 . . Privacyenhanced web service composition . . IEEE Trans Serv Comput , , 2014 . . 7 ( ( 2 ): ): 210 - - 222 . . DOI: 10.1109/TSC.2013.18 http://doi.org/10.1109/TSC.2013.18 . .

M Tschantz , , , A Datta , , , A Datta , , , 等 . . A methodology for information flow experiments . . 28 th IEEE Symp on Computer Security Foundations , , 2015 . . p.554 - - 568 . . DOI: 10.1109/CSF.2015.40 http://doi.org/10.1109/CSF.2015.40 . .

G Yee . . A privacy controller approach for privacy protection in web services . . 4 th ACM Workshop on Secure Web Services , , 2007 . . p.44 - - 51 . . DOI: 10.1145/1314418.1314426 http://doi.org/10.1145/1314418.1314426 . .

C Zhou , , , S Ju . . A Petri net based approach to covert information flow analysis . . Chin J Comput , , 2012 . . 35 ( ( 8 ): ): 1688 - - 1699 . . DOI: 10.3724/sp.j.1016.2012.01688 http://doi.org/10.3724/sp.j.1016.2012.01688 . .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

Method for process-based modeling of combat scenarios using interaction analysis weapon systems

Preserving privacy information flow security in composite service evolution

Related Author

Dongsu JEONG

Dohyun KIM

Yoonho SEO

Huan-feng PENG

Zhi-qiu HUANG

Lin-yuan LIU

Yong LI

Da-juan FAN

Related Institution

Department of Industrial and Management Engineering, Korea University

College of Computer Engineering, Nanjing Institute of Technology

College of Technology, Nanjing Audit University

Software Engineering Research Unit, University of Oulu

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰