1. CSCE 813 Internet Security Fall 2012

2. Internet Security - Farkas
Next Class
XSS attack
Today:
Project Draft
Workflow verification
Internet Security - Farkas

3. Internet Security - Farkas
Business Process
Increased complexity
Workflow specification
Workflow correctness
Workflow security
Automated analysis
Internet Security - Farkas

4. Workflow Verification
Detect conflicts and anomalies
Lack of formal methods and tools
Internet Security - Farkas

5. Internet Security - Farkas
What to represent?
Activity-based workflow model
Design-time analysis
Implementation-time verification
Reading: propositional logic
Activities
Basic workflow constructs
Activity “leads” to other activity
Internet Security - Farkas

6. Internet Security - Farkas
Workflow a2 a1 + a4
Internet Security - Farkas

7. Internet Security - Farkas
WS-BPEL
Language to specify business processes that are composed of Web services as well as exposed as Web services
WS-BPEL specifications are portable -- can be carried out by every WS-BPEL compliant execution environment
Internet Security - Farkas

8. Two-Level Programming Model
Programming in the large
Non-programmers implementing processes
Flow logic
Programming in the small
Programmers implementing low-level services
Function logic
Internet Security - Farkas

9. Internet Security - Farkas
WS-BPEL Flow Oriented
Request
Invoke
Response
SOA and WS-BPEL
Internet Security - Farkas

10. Internet Security - Farkas
Security and Workflow
Identity Management
Authorization: e.g., data access controls
Process constraints
Provenance
Internet Security - Farkas

11. Internet Security - Farkas
Issues
Need to distinguish between functionality & security guarantees
How to handle trust management?
Workflows are process or data centric
How to map to user-centric system security policies?
Planning and enactment are complex/rich processes
How to establish security assurance of a complex mechanism?
Internet Security - Farkas

12. Internet Security - Farkas
Next Class
XSS and CSRF
Internet Security - Farkas