Safety Enforcement Framework for Bring Your Own Device in Service-Oriented Architecture

点击翻译按钮获取中文摘要

Bring Your Own Device (BYOD) is an emerging application distribution model that encourages users to use their own mobile devices such as smart phones and tablet computers to access various online and mobile services in an organization, for example at work through a technical infrastructure or network, to support a workflow as long as the users agree to comply with a given safety policy in the organization. Since the services may contain sensitive information or even trade secrets of an organization, the safety policy usually specifies the security and privacy rules such as Single Sign On (SSO) and Lightweight Directory Access Protocol (LDAP) check-up of authenticity in End User Level Agreement (EULA) format as realistic regulatory measures and assessment. A Gartner report predicts over 30% of organizational BYOD strategies in the world will leverage personal applications and data in 2016 as well as half of the organizations will require employees to bring their own mobile devices for work purposes in 2017. Recently BYOD is being adopted by many traditional industries such as airline companies and even toy manufacturers around the world. From the perspective of the organization, BYOD is typically perceived as less secure and trustworthy because the organization may not be able to exercise as much control over the mobile devices as it may have over organization-issued devices. In addition, the mobile device may be used for both work related and private activities, resulting in both corporate and private data accessed and stored on that same device. From the perspective of users, there may also be concerns regarding the privacy issues of their private data while the device is interacting with the services. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground rules for how private sector organizations may collect, use, or disclose personal information in the course of commercial activities. Failing to comply with these legislations may lead to civil and/or criminal penalties and/or imprisonment. Thus the organizations must comply with PIPEDA in order to enact BYOD in Canada. This proposed research program presents a technical framework of a mobile services cluster to publish, find and bind mobile services in an emerging movable and composable structure. The mobile services are based on the technical architecture of Services Oriented Architecture (SOA) and Web services. This research program focuses on the theoretical model with a technical XML-based framework for enforcing and managing a safety policy between the mobile services cluster and mobile devices from the perspective of both organizations and users in this BYOD paradigm. The built models and research results will bring a formal solution to support a secure BYOD paradigm, especially in a mobile services cluster such as Mobile Cloud Computing (MCC), for both organizations and users in Canada.