CSCE 813 Internet Security Fall 2012

Internet Security - Farkas Next Class XSS attack Today: Project Draft Workflow verification Internet Security - Farkas

Internet Security - Farkas Business Process Increased complexity Workflow specification Workflow correctness Workflow security Automated analysis Internet Security - Farkas

Workflow Verification Detect conflicts and anomalies Lack of formal methods and tools Internet Security - Farkas

Internet Security - Farkas What to represent? Activity-based workflow model Design-time analysis Implementation-time verification Reading: propositional logic Activities Basic workflow constructs Activity “leads” to other activity Internet Security - Farkas

Internet Security - Farkas Workflow a2 a1 + a4 Internet Security - Farkas

Internet Security - Farkas WS-BPEL Language to specify business processes that are composed of Web services as well as exposed as Web services WS-BPEL specifications are portable -- can be carried out by every WS-BPEL compliant execution environment Internet Security - Farkas

Two-Level Programming Model Programming in the large Non-programmers implementing processes Flow logic Programming in the small Programmers implementing low-level services Function logic Internet Security - Farkas

Internet Security - Farkas WS-BPEL Flow Oriented Request Invoke Response SOA and WS-BPEL Internet Security - Farkas

Internet Security - Farkas Security and Workflow Identity Management Authorization: e.g., data access controls Process constraints Provenance Internet Security - Farkas

Internet Security - Farkas Issues Need to distinguish between functionality & security guarantees How to handle trust management? Workflows are process or data centric How to map to user-centric system security policies? Planning and enactment are complex/rich processes How to establish security assurance of a complex mechanism? Internet Security - Farkas

Internet Security - Farkas Next Class XSS and CSRF Internet Security - Farkas