使用信息流分析检测Web服务组合隐性信息泄露

姜家鑫; 黄志球; 马薇薇; 曹彦

doi:10.1631/FITEE.1601371

Your Location：

Home >

Browse articles >

使用信息流分析检测Web服务组合隐性信息泄露

常规文章 | Updated：2022-05-19

- 使用信息流分析检测Web服务组合隐性信息泄露
- Using information flow analysis to detect implicit information leaks for web service composition
- 信息与电子工程前沿（英文） 2018年19卷第4期页码：494-502
- Affiliations：
  
  College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 210016, China
  Collaborative Innovation Center of Novel Software Technology and Industrialization, Nanjing 210000, China
- Author bio：
  
  Jia-xin JIANG, E-mail: jiangjiaxin@nuaa.edu.cn
  [ "Zhi-qiu HUANG, E-mail: zqhuang@nuaa.edu.cn" ]
  [ "Wei-wei MA, E-mail: maweiwei@nuaa.edu.cn" ]
  [ "Yan CAO, E-mail: caoyan926@nuaa.edu.cn" ]
- Funds：
  
  Project supported by the National High-Tech R & D Program (863) of China (No. 2015AA015303) and the National Natural Science Foundation of China (No. 61272083)
- DOI：10.1631/FITEE.1601371
  中图分类号： TP311
- 收稿：2016-06-24，
  
  修回：2018-;4-;4，
  
  纸质出版：2018-04
- Accepted：
Scan QR Code
姜家鑫, 黄志球, 马薇薇, 等. 使用信息流分析检测Web服务组合隐性信息泄露[J]. 信息与电子工程前沿（英文）, 2018,19(4):494-502.

Jia-xin JIANG, Zhi-qiu HUANG, Wei-wei MA, et al. Using information flow analysis to detect implicit information leaks for web service composition[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(4): 494-502.
姜家鑫, 黄志球, 马薇薇, 等. 使用信息流分析检测Web服务组合隐性信息泄露[J]. 信息与电子工程前沿（英文）, 2018,19(4):494-502. DOI： 10.1631/FITEE.1601371.

Jia-xin JIANG, Zhi-qiu HUANG, Wei-wei MA, et al. Using information flow analysis to detect implicit information leaks for web service composition[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(4): 494-502. DOI： 10.1631/FITEE.1601371.

摘要

信息泄露会破坏Web服务组合业务流程对某些策略的遵从性，是Web服务组合中的一个主要问题。提出一种基于信息流分析的有效的自动化方法用于检测业务流程执行语言（BPEL）中的隐性信息泄露。引入Petri网元模型对BPEL进行转换和分析。以Petri网中基于库所的无干扰性概念为基础，使用Petri网可达图分析Petri网干扰性，检测Web服务组合中的隐性信息泄露，并通过一个案例说明该方法在具体BPEL工作流中的应用。

Abstract

Information leak

which can undermine the compliance of web-service-composition business processes for some policies

is one of the major concerns in web service composition. We present an automated and effective approach for the detection of implicit information leaks in business process execution language (BPEL) based on information flow analysis. We introduce an adequate meta-model for BPEL representation based on a Petri net for transformation and analysis. Building on the concept of Petri net place-based noninterference

the core contribution of this paper is the application of a Petri net reachability graph to estimate Petri net interference and thereby to detect implicit information leaks in web service composition. In addition

a case study illustrates the application of the approach on a concrete workflow in BPEL notation.

关键词

Keywords

references

R Accorsi , , , C Wonnemann . . Detective information flow analysis for business processes . . Int Conf on Business Process, Services Computing, and Intelligent Service Management , , 2009 . . p.223 - - 224 . . . .

R Accorsi , , , C Wonnemann . . Static information flow analysis of workflow models . . Int Conf on Business Process and Service Science , , 2010 . . p.194 - - 205 . . . .

R Accorsi , , , A Lehmann , , , N Lohmann . . Information leak detection in business process models: theory, application, and tool support . . Inform Syst , , 2015 . . 47 244 - - 257 . . DOI: 10.1016/j.is.2013.12.006 http://doi.org/10.1016/j.is.2013.12.006 . .

F Ahmad , , , H Huang , , , X Wang . . Petri net modeling and deadlock analysis of parallel manufacturing processes with shared-resources . . J Syst Softw , , 2010 . . 83 ( ( 4 ): ): 675 - - 688 . . DOI: 10.1016/j.jss.2009.11.705 http://doi.org/10.1016/j.jss.2009.11.705 . .

A Armando , , , S Ranise . . Automated analysis of infinite state workflows with access control policies . . 7 th Int Workshop on Security and Trust Management , , 2011 . . p.157 - - 174 . . DOI: 10.1007/978-3-642-29963-6_12 http://doi.org/10.1007/978-3-642-29963-6_12 . .

V Atluri . . Security for workflow systems . . Inform Secur Technol Rep , , 2001 . . 6 ( ( 2 ): ): 59 - - 68 . . DOI: 10.1016/S1363-4127(01)00207-2 http://doi.org/10.1016/S1363-4127(01)00207-2 . .

V Atluri , , , S Chun , , , P Mazzoleni . . A Chinese wall security model for decentralized workflow systems . . 8 th ACM Conf on Computer and Communications Security , , 2001 . . p.48 - - 57 . . DOI: 10.1145/501983.501991 http://doi.org/10.1145/501983.501991 . .

K Barkaoui , , , R Ayed , , , H Boucheneb , , , 等 . . Verification of workflow processes under multilevel security considerations . . 3 rd Int Conf on Risks and Security of Internet and Systems , , 2008 . . p.77 - - 84 . . DOI: 10.1109/CRISIS.2008.4757466 http://doi.org/10.1109/CRISIS.2008.4757466 . .

D Bell . . Secure computer systems: a retrospective . . IEEE Symp on Security and Privacy , , 1983 . . p.161 - - 162 . . DOI: 10.1109/SP.1983.10001 http://doi.org/10.1109/SP.1983.10001 . .

D Bell , , , L LaPadula . . Secure Computer Systems: Mathematical Foundations and Model . . DTIC Document , , 1973 . . .

B Benatallah , , , M Dumas , , , Z Maamar . . Definition and execution of composite web services: the self-serv project . . IEEE Data Eng Bull , , 2002 . . 25 ( ( 4 ): ): 47 - - 52 . . http://sites.computer.org/debull/A02DEC-CD.pdf http://sites.computer.org/debull/A02DEC-CD.pdf , , . .

N Busi , , , R Gorrieri . . A survey on noninterference with Petri nets , , : : ACPN Lectures on Concurrency and Petri Nets , , 2003 . . p.328 - - 344 . . . .

N Busi , , , R Gorrieri . . Structural noninterference in elementary and trace nets . . Math Struct Comput Sci , , 2009 . . 19 ( ( 6 ): ): 1065 - - 1090 . . DOI: 10.1017/S0960129509990120 http://doi.org/10.1017/S0960129509990120 . .

B Carminati , , , E Ferrari , , , P Hung . . Exploring privacy issues in web services discovery agencies . . IEEE Secur Priv , , 2005 . . 3 ( ( 5 ): ): 14 - - 21 . . DOI: 10.1109/MSP.2005.121 http://doi.org/10.1109/MSP.2005.121 . .

D Denning . . A lattice model of secure information flow . . Commun ACM , , 1976 . . 19 ( ( 5 ): ): 236 - - 243 . . DOI: 10.1145/360051.360056 http://doi.org/10.1145/360051.360056 . .

J Goguen , , , J Meseguer . . Security policies and security models . . IEEE Symp on Security and Privacy , , 1982 . . p.11 - - 20 . . DOI: 10.1109/SP.1982.10014 http://doi.org/10.1109/SP.1982.10014 . .

K Hui , , , B Tan , , , C Goh . . Online information disclosure: motivators and measurements . . ACM Trans Intern Technol , , 2006 . . 6 ( ( 4 ): ): 415 - - 441 . . DOI: 10.1145/1183463.1183467 http://doi.org/10.1145/1183463.1183467 . .

K Juszczyszyn . . Verifying enterprise's mandatory access control policies with colored Petri nets . . 12 th IEEE Int Workshops on Enabling Technologies , , 2003 . . p.184 - - 189 . . DOI: 10.1109/ENABL.2003.1231405 http://doi.org/10.1109/ENABL.2003.1231405 . .

L Kagal , , , M Paolucci , , , N Srinivasan , , , 等 . . Authorization and privacy for semantic web services . . IEEE Intell Syst , , 2004 . . 19 ( ( 4 ): ): 50 - - 56 . . DOI: 10.1109/MIS.2004.23 http://doi.org/10.1109/MIS.2004.23 . .

B Lampson . . A note on the confinement problem . . Commun ACM , , 1973 . . 16 ( ( 10 ): ): 613 - - 615 . . DOI: 10.1145/362375.362389 http://doi.org/10.1145/362375.362389 . .

N Lohmann , , , P Massuthe , , , C Stahl , , , 等 . . Analyzing interacting BPEL processes . . 4 th Int Conf on Business Process Management , , 2006 . . p.17 - - 32 . . DOI: 10.1007/11841760_3 http://doi.org/10.1007/11841760_3 . .

N Lohmann , , , E Verbeek , , , R Dijkman . . Petri net transformations for business processes-a survey . . Trans Petri Nets Other Models Concurr , , 2009 . . 2 46 - - 63 . . DOI: 10.1007/978-3-642-00899-3_3 http://doi.org/10.1007/978-3-642-00899-3_3 . .

Y Lu , , , L Zhang , , , J Sun . . Using colored Petri nets to model and analyze workflow with separation of duty constraints . . Int J Adv Manuf Technol , , 2009 . . 40 ( ( 1-2 ): ): 179 - - 192 . . DOI: 10.1007/s00170-007-1316-1 http://doi.org/10.1007/s00170-007-1316-1 . .

F Massacci , , , J Mylopoulos , , , N Zannone . . Hierarchical hippocratic databases with minimal disclosure for virtual organizations . . VLDB J , , 2006 . . 15 ( ( 4 ): ): 370 - - 387 . . DOI: 10.1007/s00778-006-0009-y http://doi.org/10.1007/s00778-006-0009-y . .

A Myers , , , B Liskov . . A decentralized model for information flow control . . 16 th ACM Symp on Operating System Principles , , 1997 . . p.129 - - 142 . . DOI: 10.1145/268998.266669 http://doi.org/10.1145/268998.266669 . .

M Papazoglou . . Cloud blueprint: a model-driven approach to configuring federated clouds . . 2 nd Int Conf on Model and Data Engineering , , 2012 . . p.1 DOI: 10.1007/978-3-642-33609-6_1 http://doi.org/10.1007/978-3-642-33609-6_1 . .

S Rhrig , , , K Knorr . . Security analysis of electronic business processes . . Electron Commerce Res , , 2004 . . 4 ( ( 1-2 ): ): 59 - - 81 . . DOI: 10.1023/B:ELEC.0000009282.06809.c5 http://doi.org/10.1023/B:ELEC.0000009282.06809.c5 . .

A Sabelfeld , , , A Myers . . Language-based informationflow security . . IEEE J Sel Areas Commun , , 2003 . . 21 ( ( 1 ): ): 5 - - 19 . . DOI: 10.1109/JSAC.2002.806121 http://doi.org/10.1109/JSAC.2002.806121 . .

B Shafiq , , , A Masood , , , J Joshi , , , 等 . . A role-based access control policy verification framework for real-time systems . . 10 th IEEE Int Workshop on Object-Oriented Real-Time Dependable Systems , , 2005 . . p.13 - - 20 . . DOI: 10.1109/WORDS.2005.11 http://doi.org/10.1109/WORDS.2005.11 . .

M Singh . . Being interactive: physics of service composition . . IEEE Intern Comput , , 2001 . . 5 ( ( 3 ): ): 6 - - 7 . . . .

H Sun , , , X Wang , , , J Yang , , , 等 . . Authorization policy based business collaboration reliability verification . . 6 th Int Conf on Service-Oriented Computing , , 2008 . . p.579 - - 584 . . DOI: 10.1007/978-3-540-89652-4_49 http://doi.org/10.1007/978-3-540-89652-4_49 . .

W Tan , , , Y Fan , , , M Zhou . . A Petri net-based method for compatibility analysis and composition of web services in business process execution language . . IEEE Trans Autom Sci Eng , , 2009 . . 6 ( ( 1 ): ): 94 - - 106 . . DOI: 10.1109/TASE.2008.916747 http://doi.org/10.1109/TASE.2008.916747 . .

S Tbahriti , , , C Ghedira , , , B Medjahed , , , 等 . . Privacyenhanced web service composition . . IEEE Trans Serv Comput , , 2014 . . 7 ( ( 2 ): ): 210 - - 222 . . DOI: 10.1109/TSC.2013.18 http://doi.org/10.1109/TSC.2013.18 . .

M Tschantz , , , A Datta , , , A Datta , , , 等 . . A methodology for information flow experiments . . 28 th IEEE Symp on Computer Security Foundations , , 2015 . . p.554 - - 568 . . DOI: 10.1109/CSF.2015.40 http://doi.org/10.1109/CSF.2015.40 . .

G Yee . . A privacy controller approach for privacy protection in web services . . 4 th ACM Workshop on Secure Web Services , , 2007 . . p.44 - - 51 . . DOI: 10.1145/1314418.1314426 http://doi.org/10.1145/1314418.1314426 . .

C Zhou , , , S Ju . . A Petri net based approach to covert information flow analysis . . Chin J Comput , , 2012 . . 35 ( ( 8 ): ): 1688 - - 1699 . . DOI: 10.3724/sp.j.1016.2012.01688 http://doi.org/10.3724/sp.j.1016.2012.01688 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Method for process-based modeling of combat scenarios using interaction analysis weapon systems

Preserving privacy information flow security in composite service evolution