With the introduction and the widely use of external hosted infrastructures, secure storage of sensitive data becomes more and more important. There are systems available to store and query encrypted data in a database, but not all applications may start with empty tables rather than having sets of legacy data. Hence, there is a need to transform existing plaintext databases to encrypted form. Usually existing enterprise databases may contain terabytes of data. A single machine would require many months for the initial encryption of a large data set. We propose encrypting data in parallel using a Hadoop cluster which is a simple five step process including the Hadoop set up, target preparation, source data import, encrypting the data, and finally exporting it to the target. We evaluated our solution on real world data and report on performance and data consumption. The results show that encrypting data in parallel can be done in a very scalable manner. Using a parallelized encryption cluster compared to a single server machine reduces the encryption time from months down to days or even hours.

Recent databases are implemented as in-memory column-stores. Adjustable encryption offers a solution to encrypted database processing in the cloud. We show that the two technologies play well together by providing an analysis and prototype results that demonstrate the impact of mechanisms at the database side (dictionaries and their compression) and cryptographic mechanisms at the adjustable encryption side (order-preserving, homomorphic, deterministic and probabilistic encryption).

In the field of business process management, deadlocks describe a situation where a workflow execution is blocked and cannot be completed. We speak of policy-based deadlocks if such a situation is caused by unsatisfiable resource requirements due to security constraints specified as part of the business process. In this paper we propose a method to avoid policy-based deadlocks by analyzing a workflow's security constraints, determine the minimal required number of users, and provide an optimal user-activity assignment for a deadlock-free workflow execution. We will finally validate our proposed approach by applying it to a real-world scenario.

Users expect that systems react instantly. This is specifically the case for user-centric workflows in business process-driven environments. In today's enterprise systems most actions executed by a user have to be checked against the system's access control policy and require a call to the access control component. Hence, improving the performance of access control decisions will improve the overall performance experienced by the end user significantly. In this paper we propose a caching strategy which pre-computes caching entries by exploiting the fact that the executions of business processes are based on the execution of actions in a predefined order. We propose an accompanying architecture and present the results of our conducted benchmark.

Whether access is given to a protected entity is decided upon evaluation of access control constraints. Though some initial approaches to classify access control constraints can be identified in the current literature, they must be considered as too broad with respect to today's multi-layered system landscapes. In this paper we present a classification model for authorization constraint types extracted from recent publications. We identify common restriction characteristics and classify the constraint types depending on their information sources necessary for constraint evaluation. We identified the following authorization classes: authentication, ontology, environment, and activity. We further propose a system architecture supporting these classes. We map our model architecture onto the Windows 2003 Authorization Manager, identify the components equal to our proposed architecture and emphasize which authorization classes are supported. We therefore show the applicability of our model to analyze existing authorization systems and determine the supported constraints.