# Distributed Secure Service Composition with Declassification in Mobile Clouds

Authors: Ning Xi; Di Lu; Cong Sun; Jianfeng Ma; Yulong Shen
Journal: Mobile Information Systems
 (2017)

---

## Abstract

The regional and dynamic characteristics of mobile clouds pose a great challenge on information flow security during service composition. Although secure verification approaches based on standard noninterference provide a solid assurance on information flow security of composite service, too strict constraints on service components may cause the failure of composition procedure. In order to ensure the availability of composite service, we specify the declassification policies based on cryptographic operations to allow data to be legally declassified. And we propose the improved distributed secure service composition framework and approach, which can realize different cloud platforms in multiple domains, cooperate with each other to complete the declassification, and secure composition procedure. Through the experiment and evaluation, it is indicated that our approach provides a more reliable and efficient way for secure service composition in mobile clouds.


---

## Body

## 1. Introduction

Mobile devices (e.g., smartphone and tablet PC) are increasingly becoming more and more popular in human life as their portability, pervasive connectivity, and various applications (e.g., iPhone and Android Apps). Particularly, in recent years, more kinds of basic functions (e.g., computation, storage, and network) are offered by cloud computing as the software services for elastic management and rapid service delivery with low cost, such as SDS (Software Defined Storage) [1], SDN (Software Defined Network) [2], and cloud- based mobile Apps. With the explosion of mobile applications and the support of cloud computing, mobile computing based on clouds provides a new and promising paradigm for delivering IT services more effectively and conveniently [3]. Moreover, services provided by different clouds and mobile terminals can be composed together to form a more powerful applications [4, 5], for example, trip mode selection application composed by Positioning service, Walking Speed service, Bus Tracking service, and Arrival Estimate service [6].However, because of the regional and heterogeneous characteristic of mobile networks, there are multiple clouds deployed in different network domains. Due to the multidomain feature of the mobile clouds, data located in different mobile terminals and domains may have different security levels, which poses a great challenge on the security of service composition across multiple mobile clouds. For instance, the personal medical records in e-health data center are with high security level, while the position of the ambulance is with lower security level. When these services are composed together for the patient’s emergency, data with different security levels are transmitted among these services, respectively. If these services are composed in an insecure way, an operation in a service may transmit confidential data to a public object and cause the information leakage. Access control has been widely used for protecting sensitive information of individual service from being released to unauthorized attackers [7]. However, for a composite service in mobile networks, data may be processed by serval services from multiple clouds dynamically. Access control cannot detect the information leakage caused by the subsequent operations in other services. Therefore, information flow security is one of the major concerns about the service composition in mobile clouds.In order to enforce the data security during the service composition, various security mechanisms have been proposed to validate the information flow in composite service based on type system, Petri nets, model checking, program static analysis, and real-time monitoring. By using type system [8], Hutter and Volkamer [9] define a set of information flow security rules that check the service composition in a secure way during the compilation of the workflow code. Petri nets provide a formal way to model composite service and Accorsi and Wonnemann [10] can identify leaks by analyzing it. Model checking is an automatic verification way that can be used to detect information leaks [11]. Nakajima [12] embedded the lattice model into the Business Process Execution Language (BPEL), and verified the absence of invalid information flows based on model checking. Program analysis is used to construct the dependence among different inputs or outputs; then information flow control (IFC) policies can be designed according to the security requirements. There are two ways to analyze the software according to the different objects, that is, static analysis for source code and dynamic analysis for executable program. For static analysis, She et al. [13, 14] define the transformation factor to measure how likely the output would depend on the input data in different candidate services. In order to improve the accuracy of static analysis, PDG (Program Dependence Graph) is used to specify the dependence between the objects in composite service [15, 16]. Compared with static analysis, dynamic analysis is built on the real-time monitoring of executing program, which can provide more accurate way to check the illegal information flow during the running time [17]. But real-time monitoring increases the cost of service execution, which may decrease the QoS and interfere with users’ experience, especially when dozens of services are composed together.Based on the above approaches, many schemes for secure service composition among clouds are proposed to address the issues of the information leakage on cloud services. Bacon et al. [18] review a range of IFC models and implementations to identify opportunities for using IFC within a cloud computing context, including type system, static analysis, and runtime dynamic analysis. Chou [19] presents the CloudIFC (Cloud Information Flow Control) model to strictly control output information flows in cloud services. Based on the specific information flow control rules and the variables dependency obtained by static analysis, they propose a novel checking way by MapReduce to decrease the verification cost. Solanki et al. [20] develop a new access and information flow control paradigm for service based systems, namely, WS-AIFC, to secure the information flow among services. Based on the dependence list for each data object, WS-AIFC supports flexible cross-domain access and information flow validation. Considering multiple domain nature of clouds, we [21] propose a distributed information flow security verification framework and approach to provide a better load balance and reduce the verification cost effectively across multiple clouds.Although the above approaches provide a solid assurance on information flow security of composite service, implementing these IFC policies in real applications is still a challenge. These policies aim at standard noninterference that characterizes the complete absence of any information flow or any causal flow from high-level entities to low level ones. However, this requirement is too strict that few services can satisfy it in real application. If all the candidate services fail in the verification, there is no available execution path, which causes the failure of the whole composite service. Meanwhile, in mobile clouds, services are bound together in a dynamic way during service composition, which means the security sensitivities of the input and output data may change when mobile terminal move into a new domain. Considering dozens of candidate services with similar service function, it will be a complex work on selecting appropriate components to compose users required application by type system, global model checking, or centralized static analysis. For type system, when user’s initial inputs change, the service codes need to be rebuilt, which brings extra cost for the secure service composition. For global model checking and centralized static analysis, it is impractical to employ a centralized entity in multiple clouds to verify the information flow security. Moreover, the cost of verification can increase rapidly when the application involves more components and the number of the candidate services increases. First, the same service component has to be reverified in different composite services. Second, the state explosion problem arises if each service component is complicated.Therefore, a distributed and efficient information flow control mechanism supporting declassifying or downgrading information is needed for the secure and reliable service composition in mobile clouds. Compared to the paper [22], we provide the following new extensions. Firstly, mobile cloud is a more complex scenario, which involves the cooperation of different cloud platforms in multiple domains during the composition, and we add more related works for a clear description. Secondly, we give more specific definitions on declassification operations and design an improved formal information flow security model supporting declassification. Thirdly, considering the limited energy and computing resource of mobile terminal, we improve the distributed secure service composition framework and algorithms for the involvement of cloud platforms, which can take over some load on service verification. Besides, more experiments and evaluations are executed for a deep analysis on our approach.The rest of the paper is structured as follows. Section2 gives a formal definition of the service chain model in mobile clouds. Section 3 presents the improved computation rules with declassifying information flow in service chain. In Section 4, we propose the secure service composition with declassification mechanism for service chain in mobile clouds. Section 5 evaluates the proposed approach. Section 6 concludes the paper.


## 2. Preliminaries

As shown in Figure1, mobile cloud MC is a large-scale distributed environment which consists of multiple heterogeneous domains; that is, MC=d0,d1,…. Domaindhas various types of data resourcesR. And services provided by mobile terminals MT or cloud platforms can be CP composed into a more powerful application according to the different customer’s requirement. For a clear description, each service provided by either terminals or clouds can be uniformly regarded as a service node in the domain; that is, SN=sn0,sn1,…. There is also a security authority DSA in each domain for the management on security policies expressed by domain certificate DCe. Due to the limited energy and computation resources of mobile terminal, there is a cloud platform CP for processing more complex tasks. So domaindcan be represented as d=SN,R,SA,DCe,CP.Figure 1
Service composition in mobile clouds.Referring to the definition in [21], each service si provided by service node SN can be represented as a tuple si=domi,Ini,Outi,Fi,SCei, where domi is the domain si belongs to; Ini is the input set of service; Outi is the output set of service; Fi is the service function. SCei is the service certificate which specifies the security properties. For each service si, there is Ini=IniM,IniD,IniL, where IniM is the set of all inputs that si receives from its predecessor si-1; IniD is all the inputs from the domain resources dom·R; IniL is all inputs from service node itself. In the same way, there is Outi=OutiM,OutiD,OutiL, where OutiM is the set of all outputs that si sends to its successor si+1. OutiD is all outputs updated to the domain resources dom·R. OutiL is all outputs written to its local storage.Service chain SC is a simplified composite service with sequence structure, which can be represented asSC=CH,Inc,Outc. CH is the execution chain of services s0,s1,…,sn+1. In CH, each service si+1 only has one predecessor si-1 and one successor si+1. For a clear description, s0 and sn+1 are used to denote the initial user. Inch and Outch are the inputs and outputs of SC including all the service components; that is, Inch=∪IniM∪IniD∪IniL, 0≤i≤n+1.Due to the complex operations in service chain and dynamic network environment, the inner-service dependencyDepinnero and interservice dependency Depintero are defined to represent the flows between different inputs and outputs based on Program Dependence Graph (PDG) [16].


## 3. Secure Information Flow Model with Declassification in Service Chain

### 3.1. Multilevel Security Model

In order to represent different sensitivities of data resources in mobile clouds, multilevel security model is defined asSL,≤, where SL is a finite set of security levels that is totally ordered by ≤ [23].For each input or output objecto in si, we define Re: Ini∪Outi→SLex maps o to the required security level of data stored in it, while Pr: Ini∪Outi→SLex maps o to its clearance level which represents o can access the corresponding-level data. The required security levels will be computed according to the dependence of the input and output data, which is described as computation rules in the following sections. The clearance levels are provided by the objects who want to access the data, which can be specified in service certificates.


### 3.2. Secure Information Flow with Standard Noninterference

For data with different security requirements, the computation rules (CRs) on required security level are defined in [16] as follows:CR1. ∀u∈IniD∪IniL,Reu=Pru.CR2. ∀u∈IniM,Reu=Reuwherev∈Outi-1M∧v∈Depinteru.CR3. ∀u∈Outi, Reu=⊔maxRevv∈Ini∪Outj, j≤i, and v∈Depu∪Depinteru.Based on the standard noninterference, we propose a strong security definition on information flow for composite service in [16].Definition 1.
The information flow in service chainSC is considered secure if ∀u∈Inch∪Outch, u satisfies Pru≥Rev, where v∈Inch∪Outch and v∈Depinneru∪Depinneru.
In this definition, it is considered secure when there is no flow from a high-level object to another low level one across all service components. However, the strong security constraints enforce the fact that the flow of information must comply with the security level ordering and do not tolerate any exceptions. To deal with real application, with the execution of the composite service, the required security levels of inputs or outputs become higher and higher according to the above CRs, which is so strict that fewer candidate service components can satisfy. In this case, it would lead to a high failure rate on service composition. Therefore, more general flow policy allowing data declassification needs to be proposed to improve the availability of composite service.


### 3.3. Secure Service Composition Model with Cryptographic Operations

Due to the strong security condition, declassification operations are needed for the secure service composition. Cryptographic operations are promising ways of maintaining data confidentiality and integrity, for example, encryption and digital signature. Through the cryptographic operations, processed secret data can be transmitted into a public object, which realizes the declassification of data. Therefore, extra cryptographic operationsEno,key and Deo,key can be add to the service function Fi for each service.f⩴a;fa⩴skin∣inputvar,e∣varp:=e∣a;a
∣ifethenaelsea∣whileea∣outputvar,e∣Envar,key∣Devar,keye⩴varp∣eReR⩴+∣-∣=∣<For∀var∈Ini∪Outi, varp and varc represent the plaintext and ciphertext of var, and the encryption and decryption operation on var are defined as Envar,key and Devar,key. Because of the low efficiency on homomorphic encryption [24], the traditional cryptographic operations are considered in this paper. As shown in Fi’s definition, the classified data varc cannot be directly processed by regular operations which may cause the plaintext of var to not be recovered. But the basic input, output, encryption, and decryption are still supported by Fi for classified data varc.When the data invar is encrypted, it provides more secure way to transmit var, and the attacker needs to work harder to crack the ciphertext which depends on the security of encryption algorithm E and the key key. Thus we use ReE,key to represent the security level of classified data varc. Encryption with more complex algorithm and key means ReE,key is lower. And the security level of var with reencryption depends on the strongest algorithm and key. When varc is decrypted, the data of var is no longer protected by encryption, and the security level of var returns to its original value. According to the analysis above, we can extend the basic computation rules as follows:CR4. ∀u∈Ini∪Outi, if u is encrypted by E,key, there is Reu=Reup∧ReE,key.CR5. For the ciphertext uc, if u is decrypted, there is Reu=ReDeuc,key=Reup.In traditional definition on standard noninterference, high security level data are not allowed to transfer to an object with lower level. The encryption operation may violate the requirements on standard noninterference. But the attacker still cannot obtain the sensitive data if he cannot crack the ciphertext, which is still considered secure although the sensitive data is transferred to an object with lower clearance. In order to specify the special downgrading flow in composite service, an extended definition on inner dependence is proposed as follows.Definition 2.
For∀u∈Outi,DepEnc,Decinneru represents the set of inputs that u depends on, where Enc is the pair of encryption algorithm and key that u adopts; Dec is the pair of decryption algorithm and key that dependent inputs adopt. Then ∀v∈Ini and ∧v∈Depinneru, there are four cases to consider:(1)
v is plaintext and u outputs as the plaintext; there is v∈Depϕ,ϕinneru.(2)
v is plaintext but u outputs as the ciphertext encrypted by Eu,keyu; there is v∈DepEu,keyu,ϕinner.(3)
v is ciphertext but u outputs as the plaintext; it means v is decrypted with Ev,keyv during the execution of service. Then there is v∈Depϕ,Ev,keyvinner.(4)
v is ciphertext and u also outputs as the ciphertext; there are three different cases:
(1)
Ifv is decrypted with Ev,keyv during the execution of service, it means v is operated as plaintext and u is encrypted by another encryption algorithm and key. Then there is v∈DepEu,keyu,Ev,keyvinner.(2)
Ifv is not decrypted but u is reencrypted by Eu,keyu, we can obtain v∈DepEu,keyu,ϕinner.(3)
Ifv is not decrypted and u is not reencrypted, there is v∈Depϕ,ϕinner.
Based on the extend inner dependence, interdependence can be defined recursively as follows.Definition 3.
∀ u ∈ I n i M ∪ O u t i , D e p E n S , D e S i n t e r u represents the set of inputs or outputs in different services that u depends on. EnS is the set of pairs of the encryption algorithm and key that is used during the execution path, while DeS represents the set of all decryption operations. For each v∈Inj∪OutjM,v∈Depinteru,0≤j<i≤N, there are three cases to consider:(1)
i=j+1: ∀u∈IniM and v∈OutjM, if v∈Depinteru, there is v∈Depϕ,ϕinteru.(2)
i=j+1: ∀u∈IniM and v∈InjM, if ∃w∈OutjM, v∈DepEncv,Decvinnerw, and w∈DepEnSw,DeSwinteru, there is v∈DepEnS,DeSinteru, where EnS=Encv∪EnSw and DeS=Decv∪DeSw.(3)
i=j+1: ∀u∈Outi,v∈OutjM, if ∃w∈IniM,v∈DepEnSv,DeSvinterw and w∈DepEncw,Decwinteru, there is v∈DepEnS,DeSinteru, where EnS=EnSv∪Encw and DeS=DeSv∪Decw.(4)
i=j+1: ∀u∈Outi and v∈Inj, if ∃w1∈OutjM, w2∈IniM, v∈DepEncv,Decvinnerw1, w1∈DepEnSw1,DeSw1interw2 and w2∈DepEncw2,Decw2inneru, there is v∈DepEnS,DeSinteru, where EnS=Encv∪EnSw1∪Encw2 and DeS=Decv∪Desw1∪Decw2.(5)
i>j+1: ∀u∈IniM and v∈Inj∪OutjM, if ∃w∈Ink∪Outk, v∈DepEnsv,Desvinterw, and w∈DepEnsw,Deswinterw,j<k<i, there is v∈DepEnS,DeSinteru, where EnS=EnSv∪EnSw and DeS=DeSv∪DeSw.
Based on the extend inner and interdependence, the improved security definition on information flow for composite service can be presented as follows.Definition 4.
The information flow in service chainSC is considered secure if ∀u,v∈Inc∪Outc, v∈Depinneru∪Depinteru satisfies the following conditions:(1)
∀u,v∈Ini∪Outi, and v∈DepEnc,Decinneru,
(i)
ifEnc-Dec=ϕ, there is Pru≥Rev;(ii)
ifEnc-Dec≠ϕ, there is Pru≥ReEu,keyu, where Eu,keyu∈Enc-Dec.(2)
∀u∈Ini∪Outi, v∈Inj∪Outj, 0≤j<i≤N, and v∈DepEns,Desinteru,
(i)
ifEnS-DeS=ϕ, there is Pru≥Rev;(ii)
ifEnS-DeS≠ϕ, there is Pru≥⨅min1≤x≤NeReEx,keyx, where Ex,keyx∈Ens-Des.
According to Definition4, two different types of flow are considered separately, that is, unclassified and classified flow. For the unclassified flow, it must satisfy the traditional information noninterference constraints, that is, the clearance on each input or output in si must be no less than the required security level, which depends on all related inputs and outputs in si and its predecessor. For the classified flow, data security depends on the encryption operation, so it can be considered secure that the clearance of the input or output is equal or greater than the required security level of the strongest encryption operation.
Based on improved information flow security definition, we can deduce the security constraints on each service as the following theorem.Theorem 1.
The information flow in service chainSC with N steps is considered secure if each si in SC satisfies the following conditions:(1)
∀u∈Outi,v∈Ini, and v∈Depinneru,
(a)
ifu is not encrypted, there is Pru≥Rev;(b)
ifu is encrypted by Eu,keyu, there is Pru≥ReEu,keyu.(2)
∀u∈IniM,v∈Outi-1M, and v∈Depinteru,
(a)
ifu is not encrypted, there is Pru≥Rev;(b)
ifu is encrypted by E,key, there is Pru≥ReE,key.Proof.
First, letN=1; then there are two service components involved in the service chain, that is, s0 and s1.Case  1. Inner information flow in each service component is considered first; that is, ∀u∈Out0, v∈In0, and v∈Depinneru.(1)
Condition (1)(a) provides that for eachv∈DepEnc,Decinneru where Enc-Dec=ϕ, there is Pru≥Rev.(2)
Condition (1)(b) provides that for eachv∈DepEnc,Decinneru where Enc-Dec≠ϕ, there is Pru≥ReEu,keyu.In the same way, we can get the information flow is also secure ins1.Case  2. Information flow between s0 and s1 is considered; that is, ∀u∈In1∪Out1, v∈In0∪Out0, and v∈Depinteru.(1)
∀u∈In1, v∈Out0, and v∈DepEnS,DeSinteru, according to Definition 3(1), there is v∈DepEnS,DeSinneru where EnS=ϕ and DeS=ϕ, and condition (2) provides Pru≥Rev.(2)
∀u∈In1, v∈In0, and v∈DepEnS,DeSinteru, according to Definition 3(2), there is ∃w∈OutjM, v∈DepEncv,Decvinnerw, and w∈Depϕ,ϕinteru.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, w is not encrypted. Condition (1)(a) provides Prw≥Rev, and condition (2)(a) provides Pru≥Rew. Therefore, Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, w is encrypted by Ew,keyw. There is EnS-DeS=Ew,keyw. Condition (1)(b) provides Prw≥ReEw,keyw. Condition (2)(a) and CR 4 provide Pru≥Rew=ReEw,keyw.(3)
∀u∈Out1 and v∈Out0, according to Definition 3(3), there is ∃w∈In1M and v∈Depϕ,ϕinteru,w∈DepEncw,Decwinneru.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, u is not encrypted. Condition (1)(a) provides Pru≥Rew, and condition (2)(a) a provides Prw≥Rev. Therefore, Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, u is encrypted by Eu,keyu. There is EnS-DeS=Eu,keyu. Condition (1)(b) provides Pru≥ReEu,keyu.(4)
∀u∈Out1, and v∈In0, according to Definition 3(4), there is ∃w1∈Out0M, w2∈In1M, v∈DepEncv,Decvinnerw1, w1∈Depφ,φinterw2, and w2∈DepEncw2,Decw2inneru, and there is v∈DepEnS,DeSinteru where EnS=Encv∪Encw2 and DeS=Decv∪Decw2.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there are two different cases:
(a)
ForEncv∪Encw2=ϕ and Decv∪Decw2=ϕ, CR 3 provides Rew1≥Rev. Condition (1)(a) provides Pru≥Rew2 and condition (2)(a) provides Prw2≥Rew2=Rew1. Therefore, Prw≥Rev.(b)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=ϕ, and Decw2=Ev,keyv, CR 5 provides Rew2p≥Rev and condition (1)(a) provides Pru≥Rew2p, so Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there are four different cases:
(a)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=ϕ, and Decw2=ϕ where EnS-DeS=Ev,keyv, condition (2)(b) provides Pru≥ReEv,keyv.(b)
ForEncv=ϕ, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=ϕ where EnS-DeS=Ew2,keyw2, condition (2)(b) provides Pru≥ReEv,keyv.(c)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=Ev,keyv where EnS-DeS=Ew2,keyw2, condition (2)(b) provides Pru≥ReEv,keyv.(d)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=ϕ where EnS-DeS=Ev,keyv,Ew2,keyw2, condition (2)(b) provides Pru≥ReEw2,keyw2≥minReEv,keyv,ReEw2,keyw2.Based on the above analysis and Definition4, information flow between s0 and s1 is secure.Therefore, Theorem1 is true when N=1.Then we assume Theorem1 is true when N=n, and the proof on N=n+1 is presented as follows.Case  1. Inner information flow in service component sn+1 is considered; that is, ∀u∈Outn+1,v∈Inn+1, and v∈Depinneru.(1)
Condition (1)(a) provides that for eachv∈DepEnc,Decinneru where Enc-Dec=ϕ, there is Pru≥Rev.(2)
Condition (1)(b) provides that for eachv∈DepEnc,Decinneru where Enc-Dec≠ϕ, there is Pru≥ReEu,keyu.And above assumption provides that information flow ins0,s1,…,sn is secure.Case  2. The assumption provides that information flow among first n service step is secure. Then the interinformation flows between sn+1 and former services are considered; that is, ∀u∈Inn+1∪Outn+1, v∈Inj∪Outj, and v∈Depinteru, 0≤j≤n+1.According to Definition3(5) and Lemma  1 in [16], there is ∃w1∈OutnM, w2∈Inn+1M, v∈DepEnS,DeSinterw1, w1∈Depφinterw2, and w2∈DepinnerEnc,Decu.(1)
Foru∈Inn+1 there is u=w2.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there is for v∈DepEnS,DeSinterw1, and w1∈Depϕ,ϕinteru where EnSv-DeSv=ϕ. Condition (2)(a) provides Pru≥Rew1 and the assumption provides Rew1≥Rev. So there is Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there is for v∈DepEnS,DeSinterw1 and w1∈Depϕ,ϕinteru where EnS-DeS=Evi,keyvi,1≤i≤n. Condition (2)(b) provides Pru≥ReEn,keyn. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(2)
Foru∈Outn+1, the following cases are considered:
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there are two cases:
(a)
Forv∈DepEnS,DeSinterw1, and w1∈Depϕ,ϕinterw2,w2∈DepEnc,Decinneru where EnSv-DeSv=ϕ and Encw2-Decw2=ϕ, condition (1)(a) provides Pru≥Rew2. CR 2 provides Rew1=Rew2. The assumption provides Rew1≥Rev. So there is Pru≥Rev.(b)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Decw2=Evi,keyvi,1≤i≤n, CR 5 provides Rew2p≥Rev and condition (1)(a) provides Pru≥Rew2p, so there is Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there are five cases:
(a)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=ϕ, condition (1)(b) provides Pru≥ReEn,keyn. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(b)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=Ew2,keyw2, there is EnS-DeS=Evi,keyvi,1≤i≤n∪Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(c)
For∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=ϕ but Decw2=Evn,keyvn, there is EnS-DeS=Evi,keyvi,1≤i≤n. Condition (1)(b) provides Pru≥ReEn-1,keyn-1. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(d)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=Ew2,keyw2 but Decw2=Evn,keyvn, there is EnS-DeS=Evi,keyvi,1≤i≤n∪Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(e)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=ϕ and Encw2-Decw2=Ew2,keyw2, there is EnS-DeS=Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2.Based on the above analysis and Definition4, information flows between sn+1 and former services si where i<n+1 are secure.Therefore, Theorem1 is also true when N=n+1.In conclusion, Theorem1 is true.Based on the above Theorem1, we can propose an improved service composition mechanism supporting declassification operations. The specific declassification policies (DPs) are presented as follows.DP 1. For ∀v∈Ini, u∈Outi, v∈Depinneru, if Pru<Rev, then u needs to be encrypted by Eu,keyu which satisfies Pru≥ReEu,keyu.DP 2. For ∀v∈OutiM, u∈Ini+1M, v∈Depinteru, if Pru<Rev, then u needs to be encrypted by Eu,keyu which satisfies Pru≥ReEu,keyu.According to the declassification policies, when the provided security level ofu cannot satisfy the strict conditions, cryptographic operations are adopted to assist in declassifying the required security level which can also hold the information flow security.


## 3.1. Multilevel Security Model

In order to represent different sensitivities of data resources in mobile clouds, multilevel security model is defined asSL,≤, where SL is a finite set of security levels that is totally ordered by ≤ [23].For each input or output objecto in si, we define Re: Ini∪Outi→SLex maps o to the required security level of data stored in it, while Pr: Ini∪Outi→SLex maps o to its clearance level which represents o can access the corresponding-level data. The required security levels will be computed according to the dependence of the input and output data, which is described as computation rules in the following sections. The clearance levels are provided by the objects who want to access the data, which can be specified in service certificates.


## 3.2. Secure Information Flow with Standard Noninterference

For data with different security requirements, the computation rules (CRs) on required security level are defined in [16] as follows:CR1. ∀u∈IniD∪IniL,Reu=Pru.CR2. ∀u∈IniM,Reu=Reuwherev∈Outi-1M∧v∈Depinteru.CR3. ∀u∈Outi, Reu=⊔maxRevv∈Ini∪Outj, j≤i, and v∈Depu∪Depinteru.Based on the standard noninterference, we propose a strong security definition on information flow for composite service in [16].Definition 1.
The information flow in service chainSC is considered secure if ∀u∈Inch∪Outch, u satisfies Pru≥Rev, where v∈Inch∪Outch and v∈Depinneru∪Depinneru.
In this definition, it is considered secure when there is no flow from a high-level object to another low level one across all service components. However, the strong security constraints enforce the fact that the flow of information must comply with the security level ordering and do not tolerate any exceptions. To deal with real application, with the execution of the composite service, the required security levels of inputs or outputs become higher and higher according to the above CRs, which is so strict that fewer candidate service components can satisfy. In this case, it would lead to a high failure rate on service composition. Therefore, more general flow policy allowing data declassification needs to be proposed to improve the availability of composite service.


## 3.3. Secure Service Composition Model with Cryptographic Operations

Due to the strong security condition, declassification operations are needed for the secure service composition. Cryptographic operations are promising ways of maintaining data confidentiality and integrity, for example, encryption and digital signature. Through the cryptographic operations, processed secret data can be transmitted into a public object, which realizes the declassification of data. Therefore, extra cryptographic operationsEno,key and Deo,key can be add to the service function Fi for each service.f⩴a;fa⩴skin∣inputvar,e∣varp:=e∣a;a
∣ifethenaelsea∣whileea∣outputvar,e∣Envar,key∣Devar,keye⩴varp∣eReR⩴+∣-∣=∣<For∀var∈Ini∪Outi, varp and varc represent the plaintext and ciphertext of var, and the encryption and decryption operation on var are defined as Envar,key and Devar,key. Because of the low efficiency on homomorphic encryption [24], the traditional cryptographic operations are considered in this paper. As shown in Fi’s definition, the classified data varc cannot be directly processed by regular operations which may cause the plaintext of var to not be recovered. But the basic input, output, encryption, and decryption are still supported by Fi for classified data varc.When the data invar is encrypted, it provides more secure way to transmit var, and the attacker needs to work harder to crack the ciphertext which depends on the security of encryption algorithm E and the key key. Thus we use ReE,key to represent the security level of classified data varc. Encryption with more complex algorithm and key means ReE,key is lower. And the security level of var with reencryption depends on the strongest algorithm and key. When varc is decrypted, the data of var is no longer protected by encryption, and the security level of var returns to its original value. According to the analysis above, we can extend the basic computation rules as follows:CR4. ∀u∈Ini∪Outi, if u is encrypted by E,key, there is Reu=Reup∧ReE,key.CR5. For the ciphertext uc, if u is decrypted, there is Reu=ReDeuc,key=Reup.In traditional definition on standard noninterference, high security level data are not allowed to transfer to an object with lower level. The encryption operation may violate the requirements on standard noninterference. But the attacker still cannot obtain the sensitive data if he cannot crack the ciphertext, which is still considered secure although the sensitive data is transferred to an object with lower clearance. In order to specify the special downgrading flow in composite service, an extended definition on inner dependence is proposed as follows.Definition 2.
For∀u∈Outi,DepEnc,Decinneru represents the set of inputs that u depends on, where Enc is the pair of encryption algorithm and key that u adopts; Dec is the pair of decryption algorithm and key that dependent inputs adopt. Then ∀v∈Ini and ∧v∈Depinneru, there are four cases to consider:(1)
v is plaintext and u outputs as the plaintext; there is v∈Depϕ,ϕinneru.(2)
v is plaintext but u outputs as the ciphertext encrypted by Eu,keyu; there is v∈DepEu,keyu,ϕinner.(3)
v is ciphertext but u outputs as the plaintext; it means v is decrypted with Ev,keyv during the execution of service. Then there is v∈Depϕ,Ev,keyvinner.(4)
v is ciphertext and u also outputs as the ciphertext; there are three different cases:
(1)
Ifv is decrypted with Ev,keyv during the execution of service, it means v is operated as plaintext and u is encrypted by another encryption algorithm and key. Then there is v∈DepEu,keyu,Ev,keyvinner.(2)
Ifv is not decrypted but u is reencrypted by Eu,keyu, we can obtain v∈DepEu,keyu,ϕinner.(3)
Ifv is not decrypted and u is not reencrypted, there is v∈Depϕ,ϕinner.
Based on the extend inner dependence, interdependence can be defined recursively as follows.Definition 3.
∀ u ∈ I n i M ∪ O u t i , D e p E n S , D e S i n t e r u represents the set of inputs or outputs in different services that u depends on. EnS is the set of pairs of the encryption algorithm and key that is used during the execution path, while DeS represents the set of all decryption operations. For each v∈Inj∪OutjM,v∈Depinteru,0≤j<i≤N, there are three cases to consider:(1)
i=j+1: ∀u∈IniM and v∈OutjM, if v∈Depinteru, there is v∈Depϕ,ϕinteru.(2)
i=j+1: ∀u∈IniM and v∈InjM, if ∃w∈OutjM, v∈DepEncv,Decvinnerw, and w∈DepEnSw,DeSwinteru, there is v∈DepEnS,DeSinteru, where EnS=Encv∪EnSw and DeS=Decv∪DeSw.(3)
i=j+1: ∀u∈Outi,v∈OutjM, if ∃w∈IniM,v∈DepEnSv,DeSvinterw and w∈DepEncw,Decwinteru, there is v∈DepEnS,DeSinteru, where EnS=EnSv∪Encw and DeS=DeSv∪Decw.(4)
i=j+1: ∀u∈Outi and v∈Inj, if ∃w1∈OutjM, w2∈IniM, v∈DepEncv,Decvinnerw1, w1∈DepEnSw1,DeSw1interw2 and w2∈DepEncw2,Decw2inneru, there is v∈DepEnS,DeSinteru, where EnS=Encv∪EnSw1∪Encw2 and DeS=Decv∪Desw1∪Decw2.(5)
i>j+1: ∀u∈IniM and v∈Inj∪OutjM, if ∃w∈Ink∪Outk, v∈DepEnsv,Desvinterw, and w∈DepEnsw,Deswinterw,j<k<i, there is v∈DepEnS,DeSinteru, where EnS=EnSv∪EnSw and DeS=DeSv∪DeSw.
Based on the extend inner and interdependence, the improved security definition on information flow for composite service can be presented as follows.Definition 4.
The information flow in service chainSC is considered secure if ∀u,v∈Inc∪Outc, v∈Depinneru∪Depinteru satisfies the following conditions:(1)
∀u,v∈Ini∪Outi, and v∈DepEnc,Decinneru,
(i)
ifEnc-Dec=ϕ, there is Pru≥Rev;(ii)
ifEnc-Dec≠ϕ, there is Pru≥ReEu,keyu, where Eu,keyu∈Enc-Dec.(2)
∀u∈Ini∪Outi, v∈Inj∪Outj, 0≤j<i≤N, and v∈DepEns,Desinteru,
(i)
ifEnS-DeS=ϕ, there is Pru≥Rev;(ii)
ifEnS-DeS≠ϕ, there is Pru≥⨅min1≤x≤NeReEx,keyx, where Ex,keyx∈Ens-Des.
According to Definition4, two different types of flow are considered separately, that is, unclassified and classified flow. For the unclassified flow, it must satisfy the traditional information noninterference constraints, that is, the clearance on each input or output in si must be no less than the required security level, which depends on all related inputs and outputs in si and its predecessor. For the classified flow, data security depends on the encryption operation, so it can be considered secure that the clearance of the input or output is equal or greater than the required security level of the strongest encryption operation.
Based on improved information flow security definition, we can deduce the security constraints on each service as the following theorem.Theorem 1.
The information flow in service chainSC with N steps is considered secure if each si in SC satisfies the following conditions:(1)
∀u∈Outi,v∈Ini, and v∈Depinneru,
(a)
ifu is not encrypted, there is Pru≥Rev;(b)
ifu is encrypted by Eu,keyu, there is Pru≥ReEu,keyu.(2)
∀u∈IniM,v∈Outi-1M, and v∈Depinteru,
(a)
ifu is not encrypted, there is Pru≥Rev;(b)
ifu is encrypted by E,key, there is Pru≥ReE,key.Proof.
First, letN=1; then there are two service components involved in the service chain, that is, s0 and s1.Case  1. Inner information flow in each service component is considered first; that is, ∀u∈Out0, v∈In0, and v∈Depinneru.(1)
Condition (1)(a) provides that for eachv∈DepEnc,Decinneru where Enc-Dec=ϕ, there is Pru≥Rev.(2)
Condition (1)(b) provides that for eachv∈DepEnc,Decinneru where Enc-Dec≠ϕ, there is Pru≥ReEu,keyu.In the same way, we can get the information flow is also secure ins1.Case  2. Information flow between s0 and s1 is considered; that is, ∀u∈In1∪Out1, v∈In0∪Out0, and v∈Depinteru.(1)
∀u∈In1, v∈Out0, and v∈DepEnS,DeSinteru, according to Definition 3(1), there is v∈DepEnS,DeSinneru where EnS=ϕ and DeS=ϕ, and condition (2) provides Pru≥Rev.(2)
∀u∈In1, v∈In0, and v∈DepEnS,DeSinteru, according to Definition 3(2), there is ∃w∈OutjM, v∈DepEncv,Decvinnerw, and w∈Depϕ,ϕinteru.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, w is not encrypted. Condition (1)(a) provides Prw≥Rev, and condition (2)(a) provides Pru≥Rew. Therefore, Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, w is encrypted by Ew,keyw. There is EnS-DeS=Ew,keyw. Condition (1)(b) provides Prw≥ReEw,keyw. Condition (2)(a) and CR 4 provide Pru≥Rew=ReEw,keyw.(3)
∀u∈Out1 and v∈Out0, according to Definition 3(3), there is ∃w∈In1M and v∈Depϕ,ϕinteru,w∈DepEncw,Decwinneru.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, u is not encrypted. Condition (1)(a) provides Pru≥Rew, and condition (2)(a) a provides Prw≥Rev. Therefore, Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, u is encrypted by Eu,keyu. There is EnS-DeS=Eu,keyu. Condition (1)(b) provides Pru≥ReEu,keyu.(4)
∀u∈Out1, and v∈In0, according to Definition 3(4), there is ∃w1∈Out0M, w2∈In1M, v∈DepEncv,Decvinnerw1, w1∈Depφ,φinterw2, and w2∈DepEncw2,Decw2inneru, and there is v∈DepEnS,DeSinteru where EnS=Encv∪Encw2 and DeS=Decv∪Decw2.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there are two different cases:
(a)
ForEncv∪Encw2=ϕ and Decv∪Decw2=ϕ, CR 3 provides Rew1≥Rev. Condition (1)(a) provides Pru≥Rew2 and condition (2)(a) provides Prw2≥Rew2=Rew1. Therefore, Prw≥Rev.(b)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=ϕ, and Decw2=Ev,keyv, CR 5 provides Rew2p≥Rev and condition (1)(a) provides Pru≥Rew2p, so Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there are four different cases:
(a)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=ϕ, and Decw2=ϕ where EnS-DeS=Ev,keyv, condition (2)(b) provides Pru≥ReEv,keyv.(b)
ForEncv=ϕ, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=ϕ where EnS-DeS=Ew2,keyw2, condition (2)(b) provides Pru≥ReEv,keyv.(c)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=Ev,keyv where EnS-DeS=Ew2,keyw2, condition (2)(b) provides Pru≥ReEv,keyv.(d)
ForEncv=Ev,keyv, Decv=ϕ, Encw2=Ew2,keyw2, and Decw2=ϕ where EnS-DeS=Ev,keyv,Ew2,keyw2, condition (2)(b) provides Pru≥ReEw2,keyw2≥minReEv,keyv,ReEw2,keyw2.Based on the above analysis and Definition4, information flow between s0 and s1 is secure.Therefore, Theorem1 is true when N=1.Then we assume Theorem1 is true when N=n, and the proof on N=n+1 is presented as follows.Case  1. Inner information flow in service component sn+1 is considered; that is, ∀u∈Outn+1,v∈Inn+1, and v∈Depinneru.(1)
Condition (1)(a) provides that for eachv∈DepEnc,Decinneru where Enc-Dec=ϕ, there is Pru≥Rev.(2)
Condition (1)(b) provides that for eachv∈DepEnc,Decinneru where Enc-Dec≠ϕ, there is Pru≥ReEu,keyu.And above assumption provides that information flow ins0,s1,…,sn is secure.Case  2. The assumption provides that information flow among first n service step is secure. Then the interinformation flows between sn+1 and former services are considered; that is, ∀u∈Inn+1∪Outn+1, v∈Inj∪Outj, and v∈Depinteru, 0≤j≤n+1.According to Definition3(5) and Lemma  1 in [16], there is ∃w1∈OutnM, w2∈Inn+1M, v∈DepEnS,DeSinterw1, w1∈Depφinterw2, and w2∈DepinnerEnc,Decu.(1)
Foru∈Inn+1 there is u=w2.
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there is for v∈DepEnS,DeSinterw1, and w1∈Depϕ,ϕinteru where EnSv-DeSv=ϕ. Condition (2)(a) provides Pru≥Rew1 and the assumption provides Rew1≥Rev. So there is Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there is for v∈DepEnS,DeSinterw1 and w1∈Depϕ,ϕinteru where EnS-DeS=Evi,keyvi,1≤i≤n. Condition (2)(b) provides Pru≥ReEn,keyn. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(2)
Foru∈Outn+1, the following cases are considered:
(i)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS=ϕ, there are two cases:
(a)
Forv∈DepEnS,DeSinterw1, and w1∈Depϕ,ϕinterw2,w2∈DepEnc,Decinneru where EnSv-DeSv=ϕ and Encw2-Decw2=ϕ, condition (1)(a) provides Pru≥Rew2. CR 2 provides Rew1=Rew2. The assumption provides Rew1≥Rev. So there is Pru≥Rev.(b)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Decw2=Evi,keyvi,1≤i≤n, CR 5 provides Rew2p≥Rev and condition (1)(a) provides Pru≥Rew2p, so there is Pru≥Rev.(ii)
If∀v∈DepEnS,DeSinteru satisfies EnS-DeS≠ϕ, there are five cases:
(a)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=ϕ, condition (1)(b) provides Pru≥ReEn,keyn. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(b)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=Ew2,keyw2, there is EnS-DeS=Evi,keyvi,1≤i≤n∪Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(c)
For∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=ϕ but Decw2=Evn,keyvn, there is EnS-DeS=Evi,keyvi,1≤i≤n. Condition (1)(b) provides Pru≥ReEn-1,keyn-1. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(d)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=Evi,keyvi,1≤i≤n and Encw2-Decw2=Ew2,keyw2 but Decw2=Evn,keyvn, there is EnS-DeS=Evi,keyvi,1≤i≤n∪Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2. So there is Pru≥⋂min1≤i≤nReEvi,keyvi.(e)
Forv∈DepEnS,DeSinterw1, w1∈Depϕ,ϕinterw2, and w2∈DepEnc,Decinneru where EnSv-DeSv=ϕ and Encw2-Decw2=Ew2,keyw2, there is EnS-DeS=Ew2,keyw2. Condition (1)(b) provides Pru≥ReEw2,keyw2.Based on the above analysis and Definition4, information flows between sn+1 and former services si where i<n+1 are secure.Therefore, Theorem1 is also true when N=n+1.In conclusion, Theorem1 is true.Based on the above Theorem1, we can propose an improved service composition mechanism supporting declassification operations. The specific declassification policies (DPs) are presented as follows.DP 1. For ∀v∈Ini, u∈Outi, v∈Depinneru, if Pru<Rev, then u needs to be encrypted by Eu,keyu which satisfies Pru≥ReEu,keyu.DP 2. For ∀v∈OutiM, u∈Ini+1M, v∈Depinteru, if Pru<Rev, then u needs to be encrypted by Eu,keyu which satisfies Pru≥ReEu,keyu.According to the declassification policies, when the provided security level ofu cannot satisfy the strict conditions, cryptographic operations are adopted to assist in declassifying the required security level which can also hold the information flow security.


## 4. Secure Service Composition with Declassification in Mobile Network

### 4.1. Secure Service Composition with Declassification Framework in Mobile Network

In the mobile cloud system with multiple domains, there are serval candidate services with same functions but different providers, which can be denoted bysi,j∈Si, 0≤i≤N, 0≤j≤Si. Traditional secure service composition approaches are based on standard information flow verification technique where insecure candidate service is filtered. However, it may be so strict that few candidate services can satisfy in real application, which leads to the failure of service composition. Based on the declassification policies, we can propose an improved secure service composition framework supporting declassification operations, which is shown in Figure 2.Figure 2
Distributed secure service composition with declassification framework.This framework is constructed as a distributed secure service composition framework involving three main kinds of entities, that is, Cloud Platform (CP), Candidate Services (CS), and Domain Security Authorities (DSA). Considering the limited energy and computation resources of mobile terminals, the verification procedure is executed by CPs. DSAs are responsible for the management on the security certificate SCe for each service node. SCe includes the provided security levels of input and outputs, the dependencies between the input and output and its public key. If the service node is fixed one, that is, services are provided by cloud platform, the certificate is generated when the service is first deployed in cloud platform. If the service node is mobile one, that is, services are provided by mobile terminal, the certificate is generated when the terminal first moves into this domain.During the verification, all candidate services send their dynamic input data and certificates to the cloud platform to finish the verification procedure. There are two different scenarios, that is, inner-domain and interdomain verification. For inner-domain verification, candidate services CP and DSA in the same domain are involved in the verification. For interdomain verification, the participant entities include not only candidate services but also two CPs and SAs in the corresponding domains.Comparing to the traditional verification procedure in [16], declassification based on cryptographic operations is executed automatically to recover the insecure information flows against the declassification policies. If the information flow security verification returns failure, each insecure component needs to negotiate a session key with its adjacent nodes for the encryption and decryption during the service execution. For clear description, we mainly focus on the declassification procedure in this paper.


### 4.2. Cryptographic Operations for Declassification in Service Composition

#### 4.2.1. Cryptographic Operation Agent

Based on the Theorem1, basic cryptographic operations must be supported by each service node to realize the declassification of information flow during the service composition. There are many relevant security specifications which have been proposed to protect data confidentiality and integrity during service execution, such as XML Encryption and Signature, WS-Security, SAML (Security Assertion Markup Language), XACML (XML Access Control Markup Language), and XKM- S (XML Key Management Specification) [25]. By developing the basic security functions supported by these specifications, a cryptographic operation agent (COA) can be designed and deployed in each service node, mobile terminal, or cloud platform, to execute the declassification operations, which is shown in Figure 3.Figure 3
Cryptographic operation agent in each service node.The cryptographic operation agent is composed of three function modules, that is, key negotiator, encryptor and decryptor. Key negotiator is responsible for the key management including key generation, negotiation with other services, key storage, and update. Encryptor and decryptor are responsible for data encryption and decryption during the service. There are two phases for agent to complete the declassification procedure, that is, key negotiation and data encryption and decryption.


#### 4.2.2. Key Negotiation Phase

Key negotiation phase is the preparation phase for the data declassification, which is also the most critical step. In this phase, for each insecure input or outputu∈Ini∪Outi, related two services negotiate for generating the appropriate encryption algorithm and key E,key to ensure the information flow security according to DPs. There are two kinds of negotiation process due to multiple domains, that is, inner-domain negotiation and interdomain negotiation, which is shown in Figures 4 and 5. The procedure of key negotiation follows the specification of XKMS (XML Key Management Specification).Figure 4
Key negotiation in the domain.Figure 5
Key negotiation across the domain.When the key negotiation begins between two adjacent service nodes, both certificates containing their own public keys are delivered to the opponents. Then the random number protected by public key is transferred to each other at the fourth and seventh step. And finally the session keykey is computed based on these random numbers with a standard key generation algorithm. Meanwhile the encryption algorithm E can also be negotiated during this procedure. In order to ensure the information flow security in the following composition, the length of the key, the complexity of the random number, the key generation algorithm, and the encryption algorithm must satisfy the requirements on security level. The pseudocode of key negotiation is presented as Algorithm 1.Algorithm 1:Key Negotiation(⋅).
Input: s i,  si-1 or si+1 Output: TrueorFalsekeyi,0M,Ei,0M,…,keyi,nM,Ei,nM and k e y i , 0 O u t , E i , 0 O u t , … , k e y i , n O u t , E i , n O u t . (1)//Ini,insecM and Outi,insec represents insecure input and outputs insi (2)if input is si-1then (3)for each input ini,xM∈Ini,insecM  do (4) Negotiate_Requestssi-1,domi-1⋅SA (5) if Key_Computationkeyi,xM,Ei,xM,Prini,xM ==False then (6)     //False means two service components can’t generate appropriate keyi,xM,Ei,xM which satisfies Prini,xM≥Rekeyi,xM,  else it return True. (7)   return False (8)    end if (9)   end for (10)  else (11) for each output outi,y∈Outi,insecdo (12) Negotiate_Requestssi+1,domi+1⋅SA (13) if Key_Computationkeyi,yOut,Ei,yOut,Prouti,y ==False then (14)  return False (15)end if (16)end for (17)end if (18)return True.keyi,0M,Ei,0M,…,keyi,nM,Ei,nM and keyi,0Out,Ei,0Out,…,keyi,nOut,Ei,nOut


#### 4.2.3. Data Declassification Phase

The data declassification phase is activated after the procedure of secure service composition. During the service execution, the COA encrypts the insecure inputs and outputs to realize the declassification on high-level data by using the session key. Meanwhile, it also realizes decryption on the cipher data for normal processing of service function.


### 4.3. Distributed Secure Service Composition with Declassification Algorithm across Multiple Mobile Clouds

During the secure service composition, cloud platformCP verifies the service chain by service step based on Theorem 1. For each candidate service si, CP first verifies whether the input objects satisfy the security condition, then compute the required security level for each output objects, and finally verify whether the output objects satisfy the security condition. Meanwhile, if there is an input or output object of si which fails to satisfy the strict security constraints, the key negotiation is executed automatically between the related services. In this case, the procedure also returns true unless key negotiation is failed. The pseudocode of verification and declassification for adjacent services is presented as Algorithm 2.Algorithm 2:Adjacent Verify & Declass(⋅).
Input: s i , s i - 1 , s i + 1 Output: TrueorFalse (1) for each ini,xM∈IniM  do (2)ifVerificationini,xM==False then (3)   Ini,insecM←ini,xM∪Ini,insecM (4)   end if (5) end for (6) ifKey_ Negotiationsi,si-1==False then (7) return False (8) end if (9) Compute Out Required si,si-1 (10) for each outi,y∈Outi  do (11) ifVerification(outi,y)==False then (12)   Outi,insec←outi,y∪Outi,insec (13) end if (14) end for (15) ifKey_ Negotiationsi,si+1==False then (16) return False (17) end if (18) return TrueBased on the verification and declassification procedure, we propose a distributed secure service composition with declassification algorithm for mobile clouds. The composition procedure is executed in a distributed way, that is, different cloud platforms in multiple domains need cooperation with each other to finish the whole procedure. There are three types of messages defined for the control on the execution of the procedure, that is, start_message, failure_message, and success_message. First, each cloud platformCP waits for the start message to start the composition procedure. Then CP receives the intermediate result of composition from the start message, including the required security level of predecessor’s output and all executable path. After that, CP generates all possible execution paths based on intermediate result and the candidate services located in its domain and verifies them. For each pathp that passed the verification, CP pushes it into passed path set PP and records its required security levels of outputs, which can be grouped as an intermediate result for the next step composition. If there is no legal path, CP would send the failure message to user to announce the failure of composition. If the final service step located in this domain, CP would send the success message with all passed path to user. If there are other steps in different domain, CP would send the start message with the intermediate result to the next cloud platform to continue the verification procedure. The distributed secure service composition with declassification algorithm is shown as Algorithm 3.Algorithm 3:Distributed Compos & Declass(⋅).
Input:  si, si+1,…,si+n∈domCP, CPsi-1, CPsi+n+1 Output: True or Flase (1)  wait for start_message (2)  Ressi-1 = ReceInterResCPsi-1 (3)  AP = GenAllPath Ressi-1⋅PP,si+1,…,si+n (4)  foreach path p∈AP  do (5) foreach step m from i-1 to i+n  do (6)  ifAdjacent Verify & Declass si,si-1,si+1  ==  True then (7)   RCount++ (8)  end if (9) end for (10) ifRCount == n  then (11)  Push p into Ressi+n⋅PP (12)  foreach outi+nM∈si+n  do (13)   Ressi+n⋅Re(outi+nM)=Re(outi+nM) (14)  end for (15) end if (16) end for (17) ifPP  ==  0 then (18) send failure_message to user S0 (19) else (20) ifi+n == N  then (21) send success message to user sN+1 (22) else (23)  send start message to next cloud platform CPsi+n+1 (24) end if (25)end if


## 4.1. Secure Service Composition with Declassification Framework in Mobile Network

In the mobile cloud system with multiple domains, there are serval candidate services with same functions but different providers, which can be denoted bysi,j∈Si, 0≤i≤N, 0≤j≤Si. Traditional secure service composition approaches are based on standard information flow verification technique where insecure candidate service is filtered. However, it may be so strict that few candidate services can satisfy in real application, which leads to the failure of service composition. Based on the declassification policies, we can propose an improved secure service composition framework supporting declassification operations, which is shown in Figure 2.Figure 2
Distributed secure service composition with declassification framework.This framework is constructed as a distributed secure service composition framework involving three main kinds of entities, that is, Cloud Platform (CP), Candidate Services (CS), and Domain Security Authorities (DSA). Considering the limited energy and computation resources of mobile terminals, the verification procedure is executed by CPs. DSAs are responsible for the management on the security certificate SCe for each service node. SCe includes the provided security levels of input and outputs, the dependencies between the input and output and its public key. If the service node is fixed one, that is, services are provided by cloud platform, the certificate is generated when the service is first deployed in cloud platform. If the service node is mobile one, that is, services are provided by mobile terminal, the certificate is generated when the terminal first moves into this domain.During the verification, all candidate services send their dynamic input data and certificates to the cloud platform to finish the verification procedure. There are two different scenarios, that is, inner-domain and interdomain verification. For inner-domain verification, candidate services CP and DSA in the same domain are involved in the verification. For interdomain verification, the participant entities include not only candidate services but also two CPs and SAs in the corresponding domains.Comparing to the traditional verification procedure in [16], declassification based on cryptographic operations is executed automatically to recover the insecure information flows against the declassification policies. If the information flow security verification returns failure, each insecure component needs to negotiate a session key with its adjacent nodes for the encryption and decryption during the service execution. For clear description, we mainly focus on the declassification procedure in this paper.


## 4.2. Cryptographic Operations for Declassification in Service Composition

### 4.2.1. Cryptographic Operation Agent

Based on the Theorem1, basic cryptographic operations must be supported by each service node to realize the declassification of information flow during the service composition. There are many relevant security specifications which have been proposed to protect data confidentiality and integrity during service execution, such as XML Encryption and Signature, WS-Security, SAML (Security Assertion Markup Language), XACML (XML Access Control Markup Language), and XKM- S (XML Key Management Specification) [25]. By developing the basic security functions supported by these specifications, a cryptographic operation agent (COA) can be designed and deployed in each service node, mobile terminal, or cloud platform, to execute the declassification operations, which is shown in Figure 3.Figure 3
Cryptographic operation agent in each service node.The cryptographic operation agent is composed of three function modules, that is, key negotiator, encryptor and decryptor. Key negotiator is responsible for the key management including key generation, negotiation with other services, key storage, and update. Encryptor and decryptor are responsible for data encryption and decryption during the service. There are two phases for agent to complete the declassification procedure, that is, key negotiation and data encryption and decryption.


### 4.2.2. Key Negotiation Phase

Key negotiation phase is the preparation phase for the data declassification, which is also the most critical step. In this phase, for each insecure input or outputu∈Ini∪Outi, related two services negotiate for generating the appropriate encryption algorithm and key E,key to ensure the information flow security according to DPs. There are two kinds of negotiation process due to multiple domains, that is, inner-domain negotiation and interdomain negotiation, which is shown in Figures 4 and 5. The procedure of key negotiation follows the specification of XKMS (XML Key Management Specification).Figure 4
Key negotiation in the domain.Figure 5
Key negotiation across the domain.When the key negotiation begins between two adjacent service nodes, both certificates containing their own public keys are delivered to the opponents. Then the random number protected by public key is transferred to each other at the fourth and seventh step. And finally the session keykey is computed based on these random numbers with a standard key generation algorithm. Meanwhile the encryption algorithm E can also be negotiated during this procedure. In order to ensure the information flow security in the following composition, the length of the key, the complexity of the random number, the key generation algorithm, and the encryption algorithm must satisfy the requirements on security level. The pseudocode of key negotiation is presented as Algorithm 1.Algorithm 1:Key Negotiation(⋅).
Input: s i,  si-1 or si+1 Output: TrueorFalsekeyi,0M,Ei,0M,…,keyi,nM,Ei,nM and k e y i , 0 O u t , E i , 0 O u t , … , k e y i , n O u t , E i , n O u t . (1)//Ini,insecM and Outi,insec represents insecure input and outputs insi (2)if input is si-1then (3)for each input ini,xM∈Ini,insecM  do (4) Negotiate_Requestssi-1,domi-1⋅SA (5) if Key_Computationkeyi,xM,Ei,xM,Prini,xM ==False then (6)     //False means two service components can’t generate appropriate keyi,xM,Ei,xM which satisfies Prini,xM≥Rekeyi,xM,  else it return True. (7)   return False (8)    end if (9)   end for (10)  else (11) for each output outi,y∈Outi,insecdo (12) Negotiate_Requestssi+1,domi+1⋅SA (13) if Key_Computationkeyi,yOut,Ei,yOut,Prouti,y ==False then (14)  return False (15)end if (16)end for (17)end if (18)return True.keyi,0M,Ei,0M,…,keyi,nM,Ei,nM and keyi,0Out,Ei,0Out,…,keyi,nOut,Ei,nOut


### 4.2.3. Data Declassification Phase

The data declassification phase is activated after the procedure of secure service composition. During the service execution, the COA encrypts the insecure inputs and outputs to realize the declassification on high-level data by using the session key. Meanwhile, it also realizes decryption on the cipher data for normal processing of service function.


## 4.2.1. Cryptographic Operation Agent

Based on the Theorem1, basic cryptographic operations must be supported by each service node to realize the declassification of information flow during the service composition. There are many relevant security specifications which have been proposed to protect data confidentiality and integrity during service execution, such as XML Encryption and Signature, WS-Security, SAML (Security Assertion Markup Language), XACML (XML Access Control Markup Language), and XKM- S (XML Key Management Specification) [25]. By developing the basic security functions supported by these specifications, a cryptographic operation agent (COA) can be designed and deployed in each service node, mobile terminal, or cloud platform, to execute the declassification operations, which is shown in Figure 3.Figure 3
Cryptographic operation agent in each service node.The cryptographic operation agent is composed of three function modules, that is, key negotiator, encryptor and decryptor. Key negotiator is responsible for the key management including key generation, negotiation with other services, key storage, and update. Encryptor and decryptor are responsible for data encryption and decryption during the service. There are two phases for agent to complete the declassification procedure, that is, key negotiation and data encryption and decryption.


## 4.2.2. Key Negotiation Phase

Key negotiation phase is the preparation phase for the data declassification, which is also the most critical step. In this phase, for each insecure input or outputu∈Ini∪Outi, related two services negotiate for generating the appropriate encryption algorithm and key E,key to ensure the information flow security according to DPs. There are two kinds of negotiation process due to multiple domains, that is, inner-domain negotiation and interdomain negotiation, which is shown in Figures 4 and 5. The procedure of key negotiation follows the specification of XKMS (XML Key Management Specification).Figure 4
Key negotiation in the domain.Figure 5
Key negotiation across the domain.When the key negotiation begins between two adjacent service nodes, both certificates containing their own public keys are delivered to the opponents. Then the random number protected by public key is transferred to each other at the fourth and seventh step. And finally the session keykey is computed based on these random numbers with a standard key generation algorithm. Meanwhile the encryption algorithm E can also be negotiated during this procedure. In order to ensure the information flow security in the following composition, the length of the key, the complexity of the random number, the key generation algorithm, and the encryption algorithm must satisfy the requirements on security level. The pseudocode of key negotiation is presented as Algorithm 1.Algorithm 1:Key Negotiation(⋅).
Input: s i,  si-1 or si+1 Output: TrueorFalsekeyi,0M,Ei,0M,…,keyi,nM,Ei,nM and k e y i , 0 O u t , E i , 0 O u t , … , k e y i , n O u t , E i , n O u t . (1)//Ini,insecM and Outi,insec represents insecure input and outputs insi (2)if input is si-1then (3)for each input ini,xM∈Ini,insecM  do (4) Negotiate_Requestssi-1,domi-1⋅SA (5) if Key_Computationkeyi,xM,Ei,xM,Prini,xM ==False then (6)     //False means two service components can’t generate appropriate keyi,xM,Ei,xM which satisfies Prini,xM≥Rekeyi,xM,  else it return True. (7)   return False (8)    end if (9)   end for (10)  else (11) for each output outi,y∈Outi,insecdo (12) Negotiate_Requestssi+1,domi+1⋅SA (13) if Key_Computationkeyi,yOut,Ei,yOut,Prouti,y ==False then (14)  return False (15)end if (16)end for (17)end if (18)return True.keyi,0M,Ei,0M,…,keyi,nM,Ei,nM and keyi,0Out,Ei,0Out,…,keyi,nOut,Ei,nOut


## 4.2.3. Data Declassification Phase

The data declassification phase is activated after the procedure of secure service composition. During the service execution, the COA encrypts the insecure inputs and outputs to realize the declassification on high-level data by using the session key. Meanwhile, it also realizes decryption on the cipher data for normal processing of service function.


## 4.3. Distributed Secure Service Composition with Declassification Algorithm across Multiple Mobile Clouds

During the secure service composition, cloud platformCP verifies the service chain by service step based on Theorem 1. For each candidate service si, CP first verifies whether the input objects satisfy the security condition, then compute the required security level for each output objects, and finally verify whether the output objects satisfy the security condition. Meanwhile, if there is an input or output object of si which fails to satisfy the strict security constraints, the key negotiation is executed automatically between the related services. In this case, the procedure also returns true unless key negotiation is failed. The pseudocode of verification and declassification for adjacent services is presented as Algorithm 2.Algorithm 2:Adjacent Verify & Declass(⋅).
Input: s i , s i - 1 , s i + 1 Output: TrueorFalse (1) for each ini,xM∈IniM  do (2)ifVerificationini,xM==False then (3)   Ini,insecM←ini,xM∪Ini,insecM (4)   end if (5) end for (6) ifKey_ Negotiationsi,si-1==False then (7) return False (8) end if (9) Compute Out Required si,si-1 (10) for each outi,y∈Outi  do (11) ifVerification(outi,y)==False then (12)   Outi,insec←outi,y∪Outi,insec (13) end if (14) end for (15) ifKey_ Negotiationsi,si+1==False then (16) return False (17) end if (18) return TrueBased on the verification and declassification procedure, we propose a distributed secure service composition with declassification algorithm for mobile clouds. The composition procedure is executed in a distributed way, that is, different cloud platforms in multiple domains need cooperation with each other to finish the whole procedure. There are three types of messages defined for the control on the execution of the procedure, that is, start_message, failure_message, and success_message. First, each cloud platformCP waits for the start message to start the composition procedure. Then CP receives the intermediate result of composition from the start message, including the required security level of predecessor’s output and all executable path. After that, CP generates all possible execution paths based on intermediate result and the candidate services located in its domain and verifies them. For each pathp that passed the verification, CP pushes it into passed path set PP and records its required security levels of outputs, which can be grouped as an intermediate result for the next step composition. If there is no legal path, CP would send the failure message to user to announce the failure of composition. If the final service step located in this domain, CP would send the success message with all passed path to user. If there are other steps in different domain, CP would send the start message with the intermediate result to the next cloud platform to continue the verification procedure. The distributed secure service composition with declassification algorithm is shown as Algorithm 3.Algorithm 3:Distributed Compos & Declass(⋅).
Input:  si, si+1,…,si+n∈domCP, CPsi-1, CPsi+n+1 Output: True or Flase (1)  wait for start_message (2)  Ressi-1 = ReceInterResCPsi-1 (3)  AP = GenAllPath Ressi-1⋅PP,si+1,…,si+n (4)  foreach path p∈AP  do (5) foreach step m from i-1 to i+n  do (6)  ifAdjacent Verify & Declass si,si-1,si+1  ==  True then (7)   RCount++ (8)  end if (9) end for (10) ifRCount == n  then (11)  Push p into Ressi+n⋅PP (12)  foreach outi+nM∈si+n  do (13)   Ressi+n⋅Re(outi+nM)=Re(outi+nM) (14)  end for (15) end if (16) end for (17) ifPP  ==  0 then (18) send failure_message to user S0 (19) else (20) ifi+n == N  then (21) send success message to user sN+1 (22) else (23)  send start message to next cloud platform CPsi+n+1 (24) end if (25)end if


## 5. Experiments and Evaluations

The information flow security can be ensured by Theorem1. And the basic comparison of different verification approaches is presented in Table 1.Table 1
Basic comparison.
Approach Framework Informationdeclassifying Hutter and Volkamer [9] Type system Centralized × Nakajima [12] Model checking Centralized ✓ She et al. [13–15] Program analysis Centralized × Chou [19] Program analysis Distributed × Solanki et al. [20] Program analysis Distributed × Xi et al. [21] Model checking Distributed × Xi et al. [16] Program analysis Distributed × This paper Program analysis Distributed ✓According to Table1, compared to [9, 13–16, 19–21], only [12] and our approach in this paper support the declassification during service composition which can ensure the availability of the composite service. Besides, approaches in [9, 12–15] all work in a centralized way while [16, 19–21] and our approach is distributed, which is more appropriate for the verification across multiple domains.In addition, we evaluate the performance of typical approaches, that is, our approach, global model checking [12], centralized program analysis [15], and distributed verification [20, 21] in multiple scenarios by using NS-3 [26]. Basic encryption functions are provided by OPENSSL library [27]. The basic settings of multiple clouds in mobile network are shown as Table 2.Table 2
Simulation Configuration.
Network settings Simulator NS-3 Fieldm2 1000 × 1000 Cloud domain 3 Cloud platform 3 Mobile nodes 100 Radio type 802.11g Mobility model RandomWalk Backbone network 1 Gbps  Security settings  Security level U, C, S, TOur simulated mobile network covers about 1000 × 1000 m2, which involves three cloud domains, three cloud platforms, and about 100 mobile nodes. For each domain in mobile network, there is one cloud platform and random number of mobile nodes. The communication adopts advanced 802.11g technology, and the mobility model for each node uses the standardRandomWalkmodel. For the backbone network, it connects different cloud domains with wired Gigabit Ethernet. Based on the settings of network, we develop multiple services and deploy them to the cloud platform and specific mobile nodes for dynamic service composition. Meanwhile, we define four different security levels for the information used in service composition, that is, unclassified (U), confidential (C), secret (S), and top secret (T), according to the standard multilevel security model which has been widely applied in government and military systems [23].Based on the designed mobile network, we simulate the service composition process in multiple mobile clouds. During the simulation, we investigate the success rate and time cost on the composition with the different number of service steps and candidate services. The variations of the simulation are shown in the Table3.Table 3
Experiment scenario.
Success rate Candidate Number 0–20 Service step 1–15 Approaches Our approach, Solanki et al. [20], She et al. [15], Xi et al. [21]  Composition Time  Candidate Number 1–15 Service step 1–8 Approaches Our approach, Xi et al. [21], She et al. [15], Nakajima [12]Figures6 and 7 show the success rate of service composition with different number of candidate services and service steps. With the increase of candidate service number, the composition procedures are more likely to be succeed. Because of the looser security constraints, the success rate of our approach increases much faster than the other approaches. Besides, for [15, 20, 21], the rate decreases vastly when there are too many service steps involved in composite service. With the execution of the verification, the requirements on the inputs and outputs become more strict and fewer candidate services can satisfy it. For our approach, most candidate services can still satisfy the information flow security constraints because of the declassification on data.Figure 6
Success rate of composition with candidate service number.Figure 7
Success rate of composition with service step.Figures8 and 9 show the cost on composition time with dynamic candidate service number and service step. When the number of candidate service or service step is small, the difference on time cost is not too much. However, for global model checking way [12] and centralized program analysis [15], they are all centralized verification approaches in which all possible composite services must be verified one by one. Therefore, with the increase of candidate services, the complexity of modeling the composite service increases vastly, and it is a time-consuming work to check the complicated model. For our approach and [21], they avoid the repetitive verification on some candidate services, so it provides an more efficient way for secure service composition as the increase of candidate services. Besides, because the key negotiation procedure is executed by related candidate services, the cloud platform can continue verifying other candidate services. Both procedures can br executed in a parallel way. Therefore, the extra effort is not evidence compared with that in [21].Figure 8
Composition time with candidate service number.Figure 9
Composition time with service step.


## 6. Conclusion

In this paper, we propose a declassification mechanism for secure service composition based on cryptographic operations and information flow security requirements. Considering the multidomain characters of mobile clouds, a distributed secure service composition with declassification framework and approach is proposed to overcome the high-rate failure of composition, which is caused by too strict security constraints in the traditional composition methods. Through the evaluation on NS-3, the results show our approach can improve the success rate of service composition effectively while the additional cost can be affordable. More dynamic declassification policies for service composition with complex structure will be considered in the future.



---

*Source: 7469342-2017-02-14.xml*