Data Protection in Organization Workflows and Service Oriented Architectures

我们解决了在具有复杂工作流的组织中遇到的数据保护问题，其中数据访问权限根据用户执行的工作流步骤而变化。这类组织存在于银行、医疗保健、政府、军事等领域。通过使用基于正式技术的纪律严明的软件工程方法，我们计划为此类组织建立数据保护系统和软件提供坚实的基础。此类组织的数据保护要求通常在规范性来源中找到，这些来源可以是法律、法规或最佳实践标准。面向服务的体系结构(Service-Oriented Architecture，SOA)是我们将用来概念化此类组织的体系结构范例：它是一个以业务为中心的范例，支持将业务流程集成为链接的、可重复的业务任务或服务。它包括Web服务、网格和云的概念。这类组织的数据保护软件应该经过彻底的验证和测试，并最终被认证为符合标准化要求。本研究的主要目标是：1)在使用数据的组织流程中，为数据保护系统开发强大而灵活的软件模型。2)从规范来源提取数据保护需求的方法3)针对需求验证模型的方法我们将使用面向模型的软件工程原理和形式化方法。这涉及到从需求构建模型、模型转换、模型检查、从模型派生实现、从模型派生测试。模型将以适当的形式规范语言指定。通过保持正确性的变换来开发模型的方法将是我们的指导方针之一。正确的设计、验证和测试将是我们关注的问题。

We address problems of data protection encountered in organizations with complex workflows, where data access privileges change depending on the workflow steps being performed by users. Such organizations are found in the area of banking, health care, government, the military etc. By using disciplined software engineering methods based on formal techniques, we plan to provide a solid base on which data protection systems and software for such organizations can be built. The data protection requirements for such organizations are often found in normative sources, which can be laws, regulations, or best practice standards. Service-Oriented Architecture (SOA) is the architectural paradigm that we will use to conceptualize such organizations: it is a business-centric paradigm that supports integrating business processes as linked, repeatable business tasks, or services. It includes concepts for Web Services, the Grid and the Cloud. The data protection software for such organizations should be thoroughly verified and tested, and in the end certified to comply with normative requirements.Major objectives of this research are to develop: 1) Strong and flexible software models for data protection systems, within the organizational processes that use the data. 2) Methods to extract data protection requirements from normative sources 3) Methods to verify the models with respect to requirementsWe will use the principles of model-oriented software engineering with formal methods. This involves model building from requirements, model transformation, model checking, derivation of implementations from the models, derivation of tests from the models. The models will be specified in appropriate formal specification languages. The method of model development by correctness-preserving transformations will be one of our guidelines. Correct design, verification and testing will be our concerns.