Forensic challenges in service oriented architectures

Digital forensics relates to the investigation of a crime or other suspect behaviour using digital evidence. Previous work has dealt with the forensic reconstruction of computer-based activity on single hosts, but with the additional complexity involved with a distributed environment, a Web services-centric approach is required. A framework for this type of forensic examination needs to allow for the reconstruction of transactions spanning multiple hosts, platforms and applications. A tool implementing such an approach could be used by an investigator to identify scenarios of Web services being misused, exploited, or otherwise compromised. This information could be used to redesign Web services in order to mitigate identified risks. This paper explores the requirements of a framework for performing effective forensic examinations in a Web services environment. This framework will be necessary in order to develop forensic tools and techniques for use in service oriented architectures.

The YAWL Architecture

The YAWL system is structured as a service-oriented architecture. It is composed of an extensible set of YAWL Services [1], each of which is deployed at a certain endpoint and offers one or multiple interfaces. Some of these services are userfacing, meaning that they offer interfaces to end users, while others offer interfaces to applications or other services.

Conceptualisation and facilitation of SOA governance

As organisations strive to improve their capabilities in the areas of Service Management and Service-oriented Architectures (SOA), SOA Governance is becoming an increasingly important success factor. However, the concept of SOA Governance is complex and not well-understood, and the adoption of an adequate SOA Governance approach in an organisation can be difficult. Tools that support SOA Governance mostly have a technical bias and rarely address organisational aspects. In this paper, we contribute to the field by specifying a conceptual meta model for SOA Governance that integrates the structure of major IT and SOA Governance frameworks into one consolidated view. By presenting this conceptualisation and a corresponding prototypical implementation of a tool that supports SOA Governance maturity assessment, reference framework exploration and company-specific tailoring of SOA Governance, we provide insights into the first step of a Design Science research project, i.e. the development of an important IT artefact.

Introduction to the Proceedings of the 1st EDOC 2009 Workshop on Service-Oriented Business Networks and Ecosystems (SOBNE '09)

The first Workshop on Service-Oriented Business Networks and Ecosystems (SOBNE ’09) is held in conjunction with the 13th IEEE International EDOC Conference on 2 September 2009 in Auckland, New Zealand. The SOBNE ’09 program includes 9 peer-reviewed papers (7 full and 2 short papers) and an open discussion session. This introduction to the Proceedings of SOBNE ’09 starts with a brief background of the motivation for the workshop. Next, it contains a short description of the peer-reviewed papers, and finally, after some concluding statements and the announcement of the winners of the Best Reviewer Award and the Most Promising Research Award, it lists the members of the SOBNE ’09 Program Committee and external reviewers of the workshop submissions.

Validating denial of service vulnerabilities in web services

The loosely-coupled and dynamic nature of web services architectures has many benefits, but also leads to an increased vulnerability to denial of service attacks. While many papers have surveyed and described these vulnerabilities, they are often theoretical and lack experimental data to validate them, and assume an obsolete state of web services technologies. This paper describes experiments involving several denial of service vulnerabilities in well-known web services platforms, including Java Metro, Apache Axis, and Microsoft .NET. The results both confirm and deny the presence of some of the most well-known vulnerabilities in web services technologies. Specifically, major web services platforms appear to cope well with attacks that target memory exhaustion. However, attacks targeting CPU-time exhaustion are still effective, regardless of the victim’s platform.

Towards a unified service description language for the internet of services : requirements and first developments

Service-oriented Architectures (SOA) and Web services leverage the technical value of solutions in the areas of distributed systems and cross-enterprise integration. The emergence of Internet marketplaces for business services is driving the need to describe services, not only from a technical level, but also from a business and operational perspective. While, SOA and Web services reside in an IT layer, organizations owing Internet marketplaces are requiring advertising and trading business services which reside in a business layer. As a result, the gap between business and IT needs to be closed. This paper presents USDL (Unified Service Description Language), a specification language to describe services from a business, operational and technical perspective. USDL plays a major role in the Internet of Services to describe tradable services which are advertised in electronic marketplaces. The language has been tested using two service marketplaces as use cases.

The rise of web service ecosystems

The convergence of Internet marketplaces and service-oriented architectures has spurred the growth of Web service ecosystems. This paper articulates a vision for Web service ecosystems, discusses early manifestations of this vision, and presents a unifying architecture to support the emergence of larger and more sophisticated ecosystems

Narcissistic and service-oriented leadership : contrasting perspectives

Leadership writing has tended to present a positive picture about leadership practice yet, in recent times, researchers have highlighted the ‘dark side’ of leadership. In this exploratory conceptual paper, we juxtapose two contrasting forms of leadership: narcissistic leadership and service-oriented leadership (that draws heavily upon servant leadership) in order to provide a better understanding of both of these forms. In particular, we explore four core constructs of leadership: service, power, role of followers, and morality, to provide a constrast. Given that little empirical works exists on narcissistic and servant leadership in educational contexts, the paper concludes by arguing for further research in the field.

Configuring processes and business documents : an integrated approach to enterprise systems collaboration

Enterprise Systems (ES) provide standardized, off-theshelf support for operations and management within organizations. With the advent of ES based on a serviceoriented architecture (SOA) and an increasing demand of IT-supported interorganizational collaboration, implementation projects face paradigmatically new challenges. The configuration of ES is costly and error-prone. Dependencies between business processes and business documents are hardly explicit and foster component proliferation instead of reuse. Configurative modeling can support the problem in two ways: First, conceptual modeling abstracts from technical details and provides more intuitive access and overview. Second, configuration allows the projection of variants from master models providing manageable variants with controlled flexibility. We aim at tackling the problem by proposing an integrated model-based framework for configuring both, processes and business documents, on an equal basis; as together, they constitute the core business components of an ES.

Dynamic weaving in aspect oriented business process management

Reducing complexity in Information Systems is an important topic in both research and industry. One strategy to deal with complexity is separation of concerns, which results in less complex, easily maintainable and more reusable systems. Separation of concerns can be addressed through the Aspect Oriented paradigm. Although this paradigm has been well researched in programming, it is still at the preliminary stage in the area of Business Process Management. While some efforts have been made to extend business process modelling with aspect oriented capability, it has not yet been investigated how aspect oriented business process models should be executed at runtime. In this paper, we propose a generic solution to support execution of aspect oriented business process models based on the principle behind dynamic weaving of aspects. This solution is formally specified using Coloured Petri Nets. The resulting formal specification serves as the blueprint to the implementation of a service module in the framework of a state-of-the-art Business Process Management System. Using this developed artefact, a case study is performed in which two simplified processes from real business in the domain of banking are modelled and executed in an aspect oriented manner. Through this case study, we also demonstrate that adoption of aspect oriented modularization increases the reusability while reducing the complexity of business process models in practice.

eHealth-as-a-Service (eHaaS) : towards universal stakeholder engagement

With the introduction of the Personally Controlled Health Record (PCEHR), the Australian public is being asked to accept greater responsibility for their healthcare by taking an active role in the management of personal health information. Although well designed, constructed and intentioned, policy and privacy concerns have resulted in an eHealth model that may impact future health sharing requirements. Hence, as a case study for a consumer eHealth initative in the Australian context, eHealth-as-a-Service (eHaaS) serves as a disruptive step in in the aggregation and transformation of health information for use as real-world knowledge. The strategic value of extending the community Health Record Bank (HRB) model lies in the ability to automatically draw on a multitude of relevant data repositories and sources to create a single source of the truth and to engage market forces to create financial sustainability. The opportunity to transform the beleaguered Australian PCEHR into a realisable and sustainable technology consumption model for patient safety is explored. Moreover, the current clerical focus of healthcare practitioners acting in the role of de facto record keepers is renegotiated to establish a shared knowledge creation landscape of action for safer patient interventions. To achieve this potential however requires a platform that will facilitate efficient and trusted unification of all health information available in real-time across the continuum of care. eHaaS provides a sustainable environment and encouragement to realise this potential.

Cultural impact on e-service use in Saudi Arabia : the need for service oriented culture

This paper reports the results of a mixed method approach to answer: To what extent do cultural values impact on e-service use in Saudi Arabia, and if so how? This paper will firstly, introduce the importance of culture and define the aspects of Saudi culture with focus on our scope: the need for Service Oriented Culture. It will then, briefly, describe the method used and present the qualitative and quantitative findings related to the need for Service Oriented Culture. This research aims to cover a gap in the literature by investigating to what extent the presence of Service Oriented Culture, as one of Saudi Arabia’s cultural values, impacts on e-service use in Saudi Arabia. Surprisingly, the tested hypothesis was rejected: the presence of Service Oriented Culture is not a positive predictor of Intention to Use e-services in Saudi Arabia. It is evidenced that consideration of the impact of the cultural values will mainly contribute to the enhancement of ICTs implementation and use.

Service Composition on a Mobile Phone

With the recent increase in interest in service-oriented architectures (SOA) and Web services, developing applications with the Web services paradigm has become feasible. Web services are self-describing, platform-independent computational elements. New applications can be assembled from a set of previously created Web services, which are composed together to make a service that uses its components to perform a certain task. This is the idea of service composition. To bring service composition to a mobile phone, I have created Interactive Service Composer for mobile phones. With Interactive Service Composer, the user is able to build service compositions on his mobile phone, consisting of Web services or services that are available from the mobile phone itself. The service compositions are reusable and can be saved in the phone's memory. Previously saved compositions can also be used in new compositions. While developing applications for mobile phones has been possible for some time, the usability of the solutions is not the same as when developing for desktop computers. When developing for mobile phones, the developer has to more carefully consider the decisions he is going to make with the program he is developing. With the lack of processing power and memory, the applications cannot function as well as on desktop PCs. On the other hand, this does not remove the appeal of developing applications for mobile devices.