Data Protection in Organization Workflows and Service Oriented Architectures

点击翻译按钮获取中文摘要

We address problems of data protection encountered in organizations with complex workflows, where data access privileges change depending on the workflow steps being performed by users. Such organizations are found in the area of banking, health care, government, the military etc. By using disciplined software engineering methods based on formal techniques, we plan to provide a solid base on which data protection systems and software for such organizations can be built. The data protection requirements for such organizations are often found in normative sources, which can be laws, regulations, or best practice standards. Service-Oriented Architecture (SOA) is the architectural paradigm that we will use to conceptualize such organizations: it is a business-centric paradigm that supports integrating business processes as linked, repeatable business tasks, or services. It includes concepts for Web Services, the Grid and the Cloud. The data protection software for such organizations should be thoroughly verified and tested, and in the end certified to comply with normative requirements. Major objectives of this research are to develop: 1) Strong and flexible software models for data protection systems, within the organizational processes that use the data. 2) Methods to extract data protection requirements from normative sources 3) Methods to verify the models with respect to requirements We will use the principles of model-oriented software engineering with formal methods. This involves model building from requirements, model transformation, model checking, derivation of implementations from the models, derivation of tests from the models. The models will be specified in appropriate formal specification languages. The method of model development by correctness-preserving transformations will be one of our guidelines. Correct design, verification and testing will be our concerns.