使用业务流程切片的发起方使用控制
Originator usage control with business process slicing
摘要：
发起方控制允许信息提供方定义信息再传播条件。结合使用控制策略，可以实现细粒度的“下游使用控制”，它指定下游消费者应该具有什么属性以及如何使用数据。本文讨论发起者使用控制，特别关注企业级动态业务联盟。我们的业务流程切片方法不是“预先定义”信息再传播路径，而是“捕获”资产派生模式，从而允许在协作环境中在资产的整个生命周期内维护发起者的策略。首先，我们提出了服务调用图（SCG），在扩展系统依赖图的基础上，来描述伙伴之间的依赖关系。当为业务流程构建SCG（和相应的“服务调用元组”列表）时，将根据它们的依赖关系将合作伙伴分组到子上下文中。发起方使用控制可以通过利用上游资产提供商的策略检查下游消费者的安全简档来实现，其关注于每个子上下文。其次，分析SCG，我们提出了两个“切片”策略，即“基于资产”和“基于请求”切片，以处理“预处理”的业务流程脚本和“在飞行中”分析服务组合的场景。最后，我们的实现工作涉及一个用于处理WS-EJB中定义的业务流程的“上下文管理器”服务。它可以与我们以前提出的策略协商和聚合服务组合，提供基于策略的端到端安全管理。并对WS-BPEL 2.0规范中的示例流程进行了实验。
英文摘要：
Originator Control allows information providers to define the information re-dissemination condition. Combined with usage control policy, fine-grained 'downstream usage control' can be achieved, which specifies what attributes the downstream consumers should have and how data is used. This paper discusses originator usage control, paying particular attention to enterprise-level dynamic business federations. Rather than 'pre-defining' the information re-dissemination paths, our business process slicing method 'capture' the asset derivation pattern, allowing to maintain originators' policies during the full lifecycle of assets in a collaborative context. First, we propose Service Call Graph (SCG), based on extending the System Dependency Graph, to describe dependencies among partners. When SCG (and corresponding 'service call tuple' list) is built for a business process, it is analyzed to group partners into sub-contexts, according to their dependency relations. Originator usage control can be achieved focusing on each sub-context, by examining downstream consumers' security profiles with upstream asset providers' policies. Second, for analyzing SCG, we propose two 'slicing' strategies, namely 'asset-based' and 'request-based' slicing, to deal with the scenarios of both 'pre-processing' a business process scripts and 'on-the-fly' analyzing service compositions. Last, our implementation work involves a 'context manager' service for processing business processes defined in WS-BPEL. It can be composed with our former proposed policy negotiation and aggregation services to provide policy-based end-to-end security management. We also make experiments based on processing the sample processes that come with 'WS-BPEL2.0' specification.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
