Dynamic Separation of Duties Enforcement in SOA Workflows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Service-Oriented Architectures (SOA), existing methods fail to enforce dynamic separation of duties (SoD) effectively at runtime, particularly in web service workflows, leading to potential security vulnerabilities due to the complex nature of web services and access controls, which makes it difficult to ensure that tasks are executed by different persons and machines to prevent fraudulent actions.
Innovation Solution
A computer-implemented method that uses a monitoring module to log and enforce SoD by specifying nodes in a policy file, passing information to an enforcer, and taking actions based on the policy file to prevent SoD violations, without requiring additional authorization models, allowing for flexible workflow execution and improved security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SoD is enforced at design time, then security compliance is achieved, but flexibility and adaptability are reduced due to complex web service access controls and delegation
Solution Approach 1:
The patent implements dynamic SoD enforcement at runtime rather than static design-time constraints. The system monitors workflow execution in real-time, capturing messages and evaluating SoD constraints dynamically based on actual task assignments and user actions, allowing the system to adapt to complex web service delegation scenarios while maintaining security compliance
Solution Approach 2:
The patent performs preliminary actions by capturing and logging messages before workflow execution completes. The monitoring module intercepts messages during workflow execution, stores them in a message pipe, and prepares them for subsequent SoD evaluation, enabling runtime enforcement without blocking workflow progress
2Reliability
If all messages are monitored to ensure SoD, then security enforcement is comprehensive, but network traffic and system overhead increase
Solution Approach 1:
The patent extracts only the necessary information from messages for SoD evaluation. Instead of monitoring and processing entire message contents, the system identifies and extracts specific nodes (task assignments, user identifiers) from messages, storing only essential data in the message pipe for later SoD constraint evaluation
Solution Approach 2:
The patent segments the message monitoring process into distinct components: message capture, node extraction, storage in message pipe, and SoD evaluation. This segmentation allows the system to process only relevant portions of messages rather than analyzing complete message contents, reducing overhead while maintaining comprehensive SoD enforcement
3Reliability
If additional authorization models are implemented for SoD, then security control is enhanced, but device complexity and operational difficulty increase
Solution Approach 1:
The patent creates a universal SoD enforcement mechanism that works across different web service workflows without requiring workflow-specific authorization models. The monitoring module and message pipe system provide generic SoD enforcement capabilities that can be applied to any workflow, eliminating the need for complex customized authorization models for each scenario
Solution Approach 2:
The system performs self-service by automatically monitoring messages, evaluating SoD constraints, and enforcing security policies without requiring external authorization infrastructure. The workflow execution environment itself provides SoD enforcement through the integrated monitoring module and enforcer, eliminating dependencies on additional authorization models
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present description refers in particular to a computer implemented method, computer program product, and computer system for dynamic separation of duties (SoD) during workflow execution. The computer implemented method may comprise: based on at least one policy file, specifying at a monitoring module at least one node to be logged from a message in a message pipe of one or more messages exchanged when executing a workflow instance; passing information on the at least one logged node to an enforcer; checking SoD violation for the at least one logged node at the enforcer; and if for the at least one logged node SoD is violated, acting based on the at least one policy file.