Formal enforcement and management of obligation policies

Obligations are generally actions that users are required to take and are essential for the expression of a large number of requirements. For instance, obligation actions may represent prerequisites to gain some privilege (pre obligations), to satisfy some ongoing or post requirement for resource usage (ongoing and post obligations), or to adhere to some privacy or availability policy. Obligations may also define states of affairs which should be maintained. An example of such obligations is the obligation “doctors should remain alert while in the operating room”. In this paper, we introduce a formal framework for the management and enforcement of obligation policies. The framework is formalized using concepts from action specification languages and the Event Condition Action paradigm of active databases. Therefore, our framework allows reasoning about change in the state of obligations and, at the same time, provides declarative formal semantics for their enforcement. In this framework, we support many types of obligations and show how to manage obligation activation, fulfillment and violation.     

基于社区权利与义务对等的P2P系统信任机制

对等网在文件共享、内容分发、分布式存储、分布式计算等众多应用领域显示出了独特的魅力,但其开放性、对等性、自主性和无监督性也带来诸如以公平和信任为核心的、具有强烈社会性属性的软安全问题。文章根据人类社会中物以类聚的现象及权利与义务的对等激励机制得到启发,提出了基于物以类聚社区的权利与义务对等的激励与信任形成模型。     

Infrastructural Support for Enforcing and Managing Distributed Application-Level Policies

State-of-the-art security mechanisms are often enforced in isolation from each other, which limits the kinds of policies that can be enforced in distributed and heterogeneous settings. More specifically, it is hard to enforce application-level policies that affect, or use information from multiple distributed components. This paper proposes the concept of a Security Service Bus (SSB), which is a dedicated communication channel between the applications and the different security mechanisms. The SSB treats the security mechanisms as reusable, stand-alone security services that can be bound to the applications and it allows the enforcement of advanced policies by providing uniform access to application-level information. This leads to a security infrastructure that is more flexible and more manageable and that can enforce more expressive policies.     

SELinux安全机制和安全目的研究

SELinux在Linux中实现了高强度但又灵活的强制访问控制(MAC)体制，提供基于机密性和完整性的信息隔离．能对抗欺骗和试图旁路安全机制的威胁．限制了因恶意代码和应用程序缺陷造成的危害。SELinux支持多种安全策略模型，支持策略的灵活改变．使用类型裁决和基于角色的访问控制来配置系统。文章给出了SELinux体系结构和安全模型，表述了安全加强的Linux是如何支持策略的灵活性和如何配置访问控制策略来满足通用操作系统的安全要求．     

工作流管理系统中规则处理问题研究

工作流管理技术作为一种重要的过程管理技术,在并行工程、企业过程重组等研究领域都获得了广泛的应用。但其在工程实施中也还存在着明显不足,主要表现在工作流的运行缺乏适应性。针对这个问题,文章讨论了ECA规则的形式化描述,提出了工作流引擎的运行控制单元模型,并在此基础上分别详细讨论了事件与规则的表示与应用。     

业务规则管理系统在信贷管理系统中的应用研究

本文在分析了业务规则管理重要性的基础上,在信贷管理系统中利用业务规则管理软件ILog JRules进行规则开发,并就业务规则开发在信贷管理系统中的权限分层、规则复用、机构分级展示等关键技术进行了研究,业务规则管理软件的引入极大的缩短了开发周期,提高了业务响应速度。     

应用安全平台体系中安全策略模型的研究

在分布式系统中,安全策略的管理是很重要的,为了对分布式系统中的安全策略方便地进行管理,并且可以适应不同类型的分布式认证系统,该文通过对RBAC96模型的研究,给出了通过结构化的语言(XML)来描述应用安全平台体系中的安全策略模型和一个实例。     

Model-based monitoring and policy enforcement of services

Runtime monitoring is necessary for continuous quality assurance of Web Services. Sensors are critical in runtime monitoring to capture the data and detect anomalies. However, sensors in current monitoring systems are usually manually instrumented or hard-coded in the program. It is expensive to implement, and inflexible to change at runtime. The paper extends our previous research on collaborative monitoring and proposes a model-based approach for automatic generating sensors and enforcing policies. Web Services standards WSDL and OWL-S are taken as the models of service interface, workflow, and semantic. Sensors are generated based on the models from two perspectives: (1) dependency analysis of the data, operations, and services with respect to the ontology model of domain concepts and usage context; (2) coverage strategies to decide the specific logic and paths to cover and the data to capture by the monitoring sensors. Policies are defined as a 3-tuple of type, subject and assertion sets and are specified using WS-Policy standards. They are associated to the sensors and enforced at runtime by the policy engine that interoperates with service execution engine to communicate runtime behavior information and verification results. Prototype system is implemented based on the Eclipse platform where sensors are implemented as the listeners to the process execution and instrumented into the middleware including the OWL-S execution engine and SOAP engine. Experiments show that the monitoring results in low overhead of the system performance, reduced effort and enhanced flexibility of sensor instrumentation.     

水上交通行政执法信息管理系统设计和实现

介绍水上交通行政执法信息管理系统的结构设计及功能实现等,并就使用情况和不足之处进行了分析。