A poster on a piece of middleware software to assist with enterprise system integration and interoperability

Wang, Lifeng

Wu, Zhengping

UB ScholarWorks

Policy Enforcement for Enterprise System Integration and Interoperability

Security Token ServiceWeb ServicesWeb Services Web PortalUser Access InterfaceHospital DomainMedical Record DatabaseTrust Establishment & Trust Relationship MonitoringSecurity Token ServiceMedical Record and Other Information ExchangeInformation Access RequestDatabase AccessTrustPolicies SecuritySecurityPoliciesTrustPoliciesPrivacyPoliciesPolicy Enforcement for Enterprise System Integration and InteroperabilityLifeng Wang,  Zhengping WuDepartment of Computer Science and EngineeringUniversity of Bridgeport, Bridgeport, CTINTRODUCTIONWhen policy-based management has beenintroduced in cross-domain organizationcollaborations and system integrations, we haveto face to a trouble which is the policies of adomain cannot directly have match enforcementmechanism in its partner domain, due to mostdifferent systems from different domains ororganizations have different high-level policydescriptions and low-level enforcementmechanisms. We have to manually update theirenforcement mechanisms for system integrationand interoperability. In this paper we propose amiddleware architecture which is used to solvethis problem. This middleware provides variousCASE STUDYFigure 3    Enforcement of policy across domain boundariesWe use the general enforcement architecture for a healthcare environment as case study.In the healthcare environment, system administrators need to define policies followingHIPAA and other regulations for all electronic medical records and other digitizedinformation; doctors and medical specialists can define security policies for medicalrecords; and patients can define their own security policies and access control policies toauthorize utilization or disclosure of their own information. As illustrated in Figure 2,system interactions between the hospital domain and the pharmacy domain, and differentcomponents within one domain are through web services. Security policies for securityflows are described in WS-Security Policy, which are used for security protections ofmedical records and access control of other patient information. Trust policies for trustflows are described by WS-Trust for cross-domain federation activities. Privacy policiesfor privacy flows are described in WS-Policy format for privacy protections within andacross domains. These policies need to be enforced in local domain as well as in domainsinvolved in interactions. Our policy enforcement architecture can help to introducepolicies to all the enforcement mechanisms of participant domains. Then, their policyenforcement for system integration and interoperability are generated automatically# 73-G :  __  __  __Pharmacy DomainUser Access InterfacePoliciesInsurance CompaniesInformation Access Request Across DomainsResearch CentersMedical Institutesfunctions to enforce policies across domainsautomatically or semi-automatically, such asgathering of policies in every participant domainand creating policy models for every domain.Once there is a new participant domain involved,its policy can be collected and integrated to thepolicy model. Finally, every specific policy rulesfollowing these models can be mapped tomultiple enforcement mechanisms of participantdomains. Once there is a policy has no matchedenforcement mechanism in participant’s domain,the policy can be reported to domainadministrator for further deployment.When a number of enterprise domains participatein a collaboration, their collaboration andcooperation activities will be under the control oftheir mutual agreement and policies from otherparticipants. It is hard to introduce a new set ofpolicy enforcement mechanisms in local systemsor applications, especially for dynamic policiesand temporary federations. This paper proposesan enforcement middleware for policy federationto help map and translate dynamic and foreignpolicies. Following the case studies, theadvantages of this enhanced new enforcementarchitecture are confirmed and can besummarized into three merits: administrators andusers can choose their high-level policy languageswith the most expressive capability; a domain’senforce mechanism is transparent to all of itspartner; system integration and interoperabilityfor policy management can be done automaticallyor semi-automatically.CONCLUSIONMIDDLEWARE ARCHITECTUREDomain A     Domain BGeneral PolicyHigh-level policy languagesIntermediate levelProcessing & TranslationDomain BPolicy of Domain AHigh-level policy languagesIntermediate levelProcessing & TranslationFigure 1  Enforcement of policy across domain boundariesFigure 2  Federated information and control flows between hospital, pharmacy domains and other domainsOur middleware have a total of three layersarchitecture, which are high-level policylanguages layer, intermediate level processingand translation layer and low level enforcementmechanism layer. Those three layer have twostructures as illustrated in figure 1, the firststructure can be explain as the left-hand sidescenario which is a policy from domain A needs tobe enforced in domain B. this situation happenswhen a new collaboration is established without anyadditional policy invoked, the policies of domain Aare enforced directly by the enforcement mechanismof its partner B. The second structure an bedescribed as the right-hand side scenario which isthat a policy needs to be enforced over these twodomains. It happens when a new collaboration isestablished with new policies invoked. Those newpolicies are obeyed by both domain and enforced bytheir enforcement mechanisms.As we know, ontology is a formal representation of aset of concepts within a domain and the relationshipsbetween concept elements. So all the models used inthis paper are described by OWL.though our middleware.

https://scholarworks.bridgeport.edu/xmlui/bitstream/handle/123456789/632/73-G.Wang.pdf?sequence=2&isAllowed=y

Policy Enforcement for Enterprise System Integration and Interoperability

Abstract

Similar works

Full text

Available Versions

UB ScholarWorks

UB ScholarWorks