License
When quoting this document, please refer to the following
URN: urn:nbn:de:0030-drops-27167
URL: http://drops.dagstuhl.de/opus/volltexte/2010/2716/
Go to the corresponding Portal


Accorsi, Rafael ; Müller, Günter

FORTES: Forensic Information Flow Analysis of Business Processes

pdf-format:
Document 1.pdf (105 KB)


Abstract

Nearly 70% of all business processes in use today rely on automated workflow systems for their execution. Despite the growing expenses in the design of advanced tools for secure and compliant deployment of workflows, an exponential growth of dependability incidents persists. Concepts beyond access control focusing on information flow control offer new paradigms to design security mechanisms for reliable and secure IT-based workflows. This talk presents FORTES, an approach for the forensic analysis of information flow properties. FORTES claims that information flow control can be made usable as a core of an audit-control system. For this purpose, it reconstructs workflow models from secure log files (i.e. execution traces) and, applying security policies, analyzes the information flows to distinguish security relevant from security irrelevant information flows. FORTES thus cannot prevent security policy violations, but by detecting them with well-founded analysis, improve the precision of audit controls and the generated certificates.

BibTeX - Entry

@InProceedings{accorsi_et_al:DSP:2010:2716,
  author =	{Rafael Accorsi and G{\"u}nter M{\"u}ller},
  title =	{FORTES: Forensic Information Flow Analysis of Business Processes},
  booktitle =	{Distributed Usage Control},
  year =	{2010},
  editor =	{Sandro Etalle and Alexander Pretschner and Raiv S. Sandhu and Marianne Winslett},
  number =	{10141},
  series =	{Dagstuhl Seminar Proceedings},
  ISSN =	{1862-4405},
  publisher =	{Schloss Dagstuhl - Leibniz-Zentrum fuer Informatik, Germany},
  address =	{Dagstuhl, Germany},
  URL =		{http://drops.dagstuhl.de/opus/volltexte/2010/2716},
  annote =	{Keywords: Audit, Information flow analysis, business processes}
}

Keywords: Audit, Information flow analysis, business processes
Seminar: 10141 - Distributed Usage Control
Issue Date: 2010
Date of publication: 05.08.2010


DROPS-Home | Fulltext Search | Imprint Published by LZI