Information Security in Business Intelligence based on Cloud: A Survey of Key Issues and the Premises of a Proposal

International audienceMore sophisticated inter-organizational interactions have generated changes in the way in which organizations make business. Advanced forms of collaborations, such as Business Process as a Service (BPaaS), allow different partners to leverage business intelligence within organizations. However, although it presents powerfull economical and technical benefits, it also arrises some pitfalls about data security, especially when it is mediated by the cloud. In this article, current aspects which have been tackled in the literature related to data risks and accountability are presented. In addition, some open issues are also presented from the analysis of the existing methodologies and techniques proposed in the literature. A final point is made by proposing an approach, which aims at preventive, detective and corrective accountability and data risk management, based on usage control policies and model driven engineering

Self-Protecting Documents for Cloud Storage Security

International audienceInformation security is currently one of the most important issues in information systems. This concerns the confidentiality of information but also its integrity and availability. The problem becomes even more difficult when several companies are working together on a project and that the various documents "go out of" their respective information systems. We propose an architecture in which the documents themselves ensure their security and thus can be exchanged over uncontrolled resources such as cloud storage or even USB flash drives. For this we encapsulate within the document itself some security components (e.g. access control, usage control) to achieve an autonomic document architecture for Enterprise DRM (E-DRM). Using such self-protecting documents, a company can ensure security and privacy for its documents when outsourcing storage services (e.g. cloud)

Service Contracts: Beyond Trust in Service Oriented Architectures

National audienceThe Service-Oriented Architecture (SOA) is considered as the most promising paradigm over the last few years for delivering functionalities and allowing business cooperation. In SOA, the traditional vision of security aims to keep properties such as availability, authenticity and confidentiality by protecting the web service itself. However, in such an approach, the particularities of the human interaction in regard to the behaviors of the service stakeholders have been until now based only on trust. In this article, we present an approach based on machine readable contracts and evidences for improving the traditional web service-centered security. Similarly, the usefulness of this approach in context of semi-automatic auditing and risk management is discussed. \textcopyright 2016 Lavoisier.The Service-Oriented Architecture (SOA) is considered as the most promising paradigm over the last few years for delivering functionalities and allowing business cooperation. In SOA, the traditional vision of security aims to keep properties such as availability, authenticity and confidentiality by protecting the web service itself. However, in such an approach, the particularities of the human interaction in regard to the behaviors of the service stakehold-ers have been until now based only on trust. In this article, we present an approach based on machine readable contracts and evidences for improving the traditional web service-centered security. Similarly, the usefulness of this approach in context of semi-automatic auditing and risk management is discussed. RÉSUMÉ. L'architecture orientée services (SOA) est considérée comme le paradigme le plus prometteur au cours des dernières années pour fournir des fonctionnalités et faciliter la coo-pération commerciale.Dans le SOA, la vision traditionnelle de la sécurité vise à garder des propriétés telles que la disponibilité, l'authenticité et la confidentialité, en protégant le service Web lui-même. Cependant, dans une telle approche les particularités de l'interaction humaine en ce qui concerne les comportements des parties prenantes de service ont été jusqu'à présent basée seulement sur la confiance. Dans cet article, nous présentons une approche basée sur des contrats lisibles par la machine et des preuves pour enrichir la vision traditionannelle de la sécurité axée sur les services web. De même, l'utilité de cette approche dans le contexte de la gestion de risques et l'audit semi-automatique est discutée

Towards Modelling and Analysing Non-Functional Properties of Systems of Systems

International audienceSystems of systems (SoS) are large-scale systems composed of complex systems with difficult to predict emergent properties. One of the most significant challenges in the engineering of such systems if how to predict their Non-Functional Properties (NFP) such as performance and security, and more specifically, how to model NFP when the overall system functionality is not available. In this paper, we identify, describe and analyse challenges to modelling and analysing the performance and security NFP of SoS. We define an architectural framework to SoS NFP prediction based on the modelling of system interactions and their impacts. We adopt an Event Driven Architecture to support this modelling, as it allows for more realistic and flexible NFP simulation, which enables more accurate NFP prediction. A framework integrating the analysis of several NFP allows for exploring the impacts of changes made to accommodate issues on one NFP on other NFPs

Comparison of phenolic and volatile profiles of edible and toxic forms of Detarium senegalense J. F. GMEL

In Senegal, Detarium senegalense J.F. Gmel. (ditax in Wolof) is one of the most important important forest fruit species. However, exploitation of the edible fruit is based on local people's knowledge. Only trees whose fruits are consumed by animals are exploited. To identify them, a chemical comparison of edible and toxic forms was done in order to highlight differences between both forms. Dichloromethane leaf extracts from toxic and edible trees were analyzed by gas chromatography. Phenolic profile and volatile compounds from fruits extracts were studied respectively by High Performance Liquid Chromatography-mass spectrometry (HPLC-MS) and Gas Chromatography Mass Spectrometry (GC-MS). Cytotoxicity effect of fruits extracts was evaluated on murine macrophage cells J774 A1. GC-analysis of dichloromethane leaf extracts revealed the presence of lupenone and lupeol only in toxic extracts. 6'-O-galloyl-epiheterodendrin and isovaleronitrile were detected in toxic pulp. However, no cytotoxic effect was found in our conditions. This study has given the opportunity to identify within the same species, compounds which could differentiate both edible and toxic forms. Nevertheless further studies are needed to better understand which compounds are responsible for toxicity in the toxic form. (Résumé d'auteur

Cooperation Services for Widely Distributed Applications

Colloque avec actes et comité de lecture.Due to the popularization of Internet, widely distributed cooperative applications are expected to become commonplace on the Web. Virtual enterprises and mobile computing are good examples of such distributed applications. They both involve several actors connected together and needing to co-operate by sharing some (possibly unstable) data. To ensure consistency of shared data, traditional distributed systems are based on a client/server architecture. However, this implies that client activities have to be connected to the server continuously. This paper describes our approach to build distributed cooperative applications using a peer-to-peer architecture. An activity is viewed as a self contained component which cooperates with other components by exchanging, during its execution, some results. To ensure consistency of shared data, two activities have to negotiate a cooperation pattern first, which purpose is to control subsequent exchanges of these data between these two activities

An Access Control Model for Tree Data Structure

International audienceTrees are very often used to structure data. For instance, file systems are structured into trees and XML documents can be represented by trees. There are literally as many access control schemes as there are tree data structures. Consequently, an access control model which has been defined for a particular kind of tree cannot be easily adapted to another kind of tree. In this paper, we propose an access control model for generic tree data structures. This model can then be applied to any specific typed tree data structure

Un système coopératif basé sur les transactions

Colloque avec actes et comité de lecture. nationale.National audienceLa conception ou la réalisation de tout projet un tant soit peu conséquent sous-entend l?implication d?un certain nombre de personnes, voire d?un certain nombre d?équipes ou d?entreprises. Outre le fait qu?ils travaillent tous sur le même projet, les différents acteurs coopèrent et collaborent. En effet la réalisation de tout projet n?est pas faite en une succession d?étapes menées par un seul acteur mais par une synergie d?acteurs coopérant à la réalisation d?un but commun. C?est le concept même d?ingénierie concourante. Celle-ci nécessite une coopération entre les différents acteurs et un échange des données produite par chacun d?entre eux. De plus en plus d?entreprises utilisant internet pour l?échange de données, les différents acteurs ne sont alors plus soumis à l?obligation de travailler dans un même lieu géographique. On parle alors d?entreprise virtuelle ou d?entreprise-projet si le travail en commun dure le temps d?un projet. Cependant, il ne suffit pas simplement d?échanger des données pour travailler ensemble, il faut aussi contrôler et gérer ces échanges. La collaboration impliquant une certaine concourance dans le travail de plusieurs acteurs, la production de différentes versions des documents échangés implique un contrôle des échanges. L?objectif de cet article est la description d?un système de coopération réellement distribué. La philosophie globale de notre système est la distribution du contrôle des échanges et l?accès aux données échangées de manière standard. Adoptant une approche transactionnelle pour la réalisation de notre système de coopération, nous avons formalisés notre système transactionnel coopératif et notre critère de correction distribué (DisCOO-sérialisabilité). Dans cet article, nous nous servons d?un exemple support pour illustrer notre propos et appliquer cette formalisation à un cas concret. Nous présentons le prototype DisCOO (réalisé en Java et Prolog au-dessus d?un ORB) mettant en oeuvre notre système

A transactional approach for cross-organizational cooperation

http://ieeexplore.ieee.org/Due to the popularization of Internet, virtual enterprises are expected to become commonplace on the WEB. The concept of virtual enterprise depicts the idea that many applications are the result of cross-organisational cooperation between several actors, playing different roles, who build a relational system which is structured by a common objective. Virtual enterprises can be short- or long-lived. The objective of our work is to develop a framework to install and to support cooperation betwen the partners of a virtual enterprise, with a particular focuss on concurrent engineering applications, and especially on co-design activities. We have chosen a transactional approach which releases programmers from the burden of interaction programming, and this approach has been implemented in a distributed manner using a cooperation model requesting a partner to negotiate cooperation patterns with its direct neighbours

A Negotiation Model for CSCW

Colloque avec actes et comité de lecture. internationale./http://www.springerlink.comInternational audienceThe aim of this paper is to present our model for a generic and flexible negotiation service and its implementation in Computer Supported Collaborative Work (CSCW) environments. Within a cooperative work environment, users naturally need negotiation support mechanisms to study possible alternatives in group decision making. The objective of our work is to build a negotiation model independent of any particular application field. Contrary to studied models, our model focuses on formalizing the negotiation from three points of view: exchanged information between the agents to negotiate (the language), the way this information is exchanged (the protocol), and the internal behavior of an agent (the tactics). In addition to a separation of the problems involved in each one of these three facets of the negotiation, this approach allows also a greater flexibility than traditional systems dedicated to one kind of problems. We chose to use a transactional approach based on speech acts to develop our axiom based negotiation model which has been implemented as a negotiation service in our CSCW environment DisCOO. After the tackled problem presentation, we will expose the state of the art, then the proposed negotiation formal model, and, finally, the implementation