Data Protection in Organization Workflows and Service Oriented Architectures

我们解决在具有复杂工作流的组织中遇到的数据保护问题，其中数据访问权限根据用户执行的工作流步骤而更改。这些组织存在于银行、保健、政府、军队等领域。通过使用基于正式技术的有纪律的软件工程方法，我们计划提供一个坚实的基础，在此基础上可以为此类组织构建数据保护系统和软件。此类组织的数据保护需求通常可以在规范性来源中找到，这些规范性来源可以是法律、法规或最佳实践标准。面向服务的体系结构（SOA）是我们将用于概念化此类组织的体系结构范例：它是一个以业务为中心的范例，支持将业务流程集成为链接的、可重复的业务任务或服务。它包含了Web服务、网格和云的概念。这些组织的数据保护软件应该经过彻底的验证和测试，并最终通过认证以符合规范要求。

We address problems of data protection encountered in organizations with complex workflows, where data access privileges change depending on the workflow steps being performed by users. Such organizations are found in the area of banking, health care, government, the military etc. By using disciplined software engineering methods based on formal techniques, we plan to provide a solid base on which data protection systems and software for such organizations can be built. The data protection requirements for such organizations are often found in normative sources, which can be laws, regulations, or best practice standards. Service-Oriented Architecture (SOA) is the architectural paradigm that we will use to conceptualize such organizations: it is a business-centric paradigm that supports integrating business processes as linked, repeatable business tasks, or services. It includes concepts for Web Services, the Grid and the Cloud. The data protection software for such organizations should be thoroughly verified and tested, and in the end certified to comply with normative requirements. Major objectives of this research are to develop: 1) Strong and flexible software models for data protection systems, within the organizational processes that use the data. 2) Methods to extract data protection requirements from normative sources 3) Methods to verify the models with respect to requirements We will use the principles of model-oriented software engineering with formal methods. This involves model building from requirements, model transformation, model checking, derivation of implementations from the models, derivation of tests from the models. The models will be specified in appropriate formal specification languages. The method of model development by correctness-preserving transformations will be one of our guidelines. Correct design, verification and testing will be our concerns.