Abstract Peer-to-Peer Form Based Web Information Systems

StijnDekeyser1

1

JanHidders2RichardWatson1RonAddie1

UniversityofSouthernQueensland,Australia

2UniversityofAntwerp,Belgium

Abstract

TheinmoveeverydayWorldWideitalawayfromprivateWebrevolutionizedtheuseofformspaperandformsbusinesstoeasilylifebyallowingacouldforms.applicationsbeprocessedDatacapturedusingrelationalusingsuchaccessibledatabasesHTMLorformsdig-otherLatelythatenforceandapplybusinesslogic.icaltionevolutionXFormsofhasdigitalbeendataintroduced,captureofferingalog-TheThisusingpaperInternetintroducesanddocumentanddissemina-twoimportanttechnology.

typefirstoneisthemainfocusofthepaper:newaideas.formsofcessarepeer-to-peerfirst-classcitizenswebinformationcontainingsystemnovelextendedwhereandrulesforms.updateofinaryThesecondrightsveryfinegranularitywhichgovernreadac-idea,todatawhichobjectsweexploreassociatedtotheofsection,formsapowerfulmotivationinforaprelim-theusetionsuchtainedofworkflowsystems:processestheautomaticfromandtheaccessdynamicrulesderiva-con-formsAsinsuch,forms.

theproposedsystemleveragescurrentandanduseandofInternetformsandtechnologyreports,toliberatethecreationmanagementdisseminationofworkofflowsdata,withinwhilefacilitatingorganizations.allowingthedynamiccapture1

Introduction

Theperbackgroundforthetheorydevelopedinthispa-ematicsisareal-lifetothrougheasily&captureComputingproblem.datafromatTheUSQDepartmentofMath-colleagueswouldandlikestudentsitsstaffandcompromisingre-useweb-basedthedataforms,capturedefficientlybystorethatdata,outdatabasestaffhavingsecuritytoscriptandtheiraccessownrights,others,webpagesandwithoutwith-witheryonefunctionality.Inaddition,whilegivingev-data-driventheopportunitymustapplications,tothecreatesystemcomplexwhichinteractiveallowsthisontionsdifferentbeableform.whichpeers,tocommunicatemakeandwithothersuchsystemsuptheshowworkflowend-usersrepresentedthevariousbyac-aadditionThesteps.

ofworkflownewformsisnotmaydefinedaddoraalterpriori;individualinstead,retaryLetusconsiderabriefexample.SupposetoThebetotheDeancreatesaLeaveApplicationtheformsec-Deanfilledinmustbystaffapprovememberstheapplication,priortogoingafteronwhich

leave.Copyright󰀁

c2006,AustralianComputerSociety,Inc.Thispa-perappearedatTheSeventeenthAustralasianDatabaseCon-ference(ADC2006),Hobart,Tasmania.ConferencesinRe-searchandPracticeinInformationTechnology,Vol.17.GillianDobbie,Ed.Reproductionforacademic,not-forprofitpur-posespermittedprovidedthistextisincluded.

itanymore.issenttomayPriorhumantotheresourcesandcannotbealterednotchangethedatesDean’softheapplication,approval,thebutapplicanthecan-isgivedecideddosothataftertheapprovalHeadisgiven.Monthslater,itpleaseparateapproval,ofpriorDepartmenttotheDean’s.(HoD)Amustsim-informationchangeofchangesandthealterform’sthedefinitionoriginalmustaddthisnewentAnothertheexampleworkflowingraph.

accessrules,whichwhichdataisre-usedbystaffpeersintionswhichmemberisgiventheyJohnbycanentermakesthePublicationsForm.Supposediffer-andaformalteravailabledetailsoftoallstaffpartsofotherofwhichtheyareanauthor,andletotherspublica-useShestaffthemember,enteredJill,information.wantstoNowextendsupposethisform.an-datamightusersobjects,createbutaextendsformdefinitionthemthatre-usesJohn’sbasicmayenterdataineitherform,withafterherown.whichEnd-theavailablepublicationsatisfied.

toeveryone,dataasaslongdefinedastheinaccessJohn’srightsformareisingThesetemsatwoscenariosconstituteabasisforpropos-inginnewwhichparadigmformsareforfirst-classwebbasedcitizensinformationrepresent-sys-flowscomplex,presentareindynamicallydistributedformdefinitions.

builtinstancesupfromandtheinwhichaccesswork-rulesMotivation.temTothebestofourknowledge,aCurrently,thatallowsvariouspartsallofthesethefunctionsdoesnotyetexist.sys-datauserscantechniquesandtools.problemForcanexample,besolvedcapturingusingbycreatebetheirdoneownbyatablesdistributedandre-usedatabase,informationwherecanusingscripts,begeneratedviews1definedusingbyHTMLothers.ElectronicformsmayInbeusedorthedependingrecentXFormsandspecialpurposeon[14]recommendationaarately.conceptthelatterofcase,workflow,accessstillrightsavailableneedtodataimplementations.tobeelements,codedsep-and[7,tation22])Finally,commercialworkflowsystems(e.g.organization,performedrequireacomplexusuallydesignbyspecialistsphaseandoutsideimplemen-ofactionstation.

requireafteranewwhichcycleadaptationsofdesignandintheimplemen-businesstheareHence,trulyasfollows.thetwoFirstly,mainwemotivationswanttoultimatelyforthisresearchcreateeasyenablingsoftwarethatallowsindividualsafairlythemwayportsthattowillcreatebeelectronicstoredefficiently,forms,capturedatawiththoseofallowedofdataother,captureddistributed,bytheirusersownandsoformsgeneratelongasbutthisalsore-Secondly,byaccessisasformsrules.

definedinthesysteminclude

1

Thisthenraisestheproblemofupdatingrelationalviews.

accesssociatedrights,designwithathem.workflowThereprocessisnoisneedautomaticallyforas-datesincrementallytophasetheaccessforconstructingrules(ornewaworkflow,onesinaandacomplexnewanyform)up-ditionatorsendoftomodifytheassociatedworkflow.Inad-formsthissignificantaneasymethodbenefit,towecheckwantiftogivecre-wantstates(iftiesthistoisinformoftheallowedusersformcanindeedbereached,thedesiredandbytheofacreator).formhowThesethedataisusedtheworkflowthatcanbeisconstructed.

derivedoncethegraphrepresentingareproper-Contribution.naturallycontributiontranslateThemalizationofthisintwinmotivationslistedabovepaper,tworesearchgoals.Themainmationforms,system.ofthehowever,lieswiththefor-Specificallyform-basedwepeer-to-peerwebinfor-fifthAsecondaryanddefinecontributiontheaccessrulesformalizeschemasforlieslanguage.

intheatedsectionbyaccesstotherulesderivationbydescribinginforms.

ofworkflowresearchprocessesquestionsexploratoryimpliedassoci-Organization.IncalSection2wediscussThispaperisorganizedasfollows.formalworkrelatedtoours.bothInSectiontechnical3weandpresenttheoreti-themationmodelinasSectionsystems.forform-basedpeer-to-peerwebinfor-4WepresenttheaccessrulelanguageaexploredwhichinSectionwillalso5.Finally,beusedintoSectioninferworkflows,linebriefworkflowtheconclusion,nextprocessesstepsindiscussinourelectronicongoingimplementations,6andwegiveout-formresearchsystems.ofdeciding2

RelatedWork

Thepointexamplesbrieflydescribedcanabetousedbothavarietyoftoolsinandthesystemsintroductionthatbeingvarietyoffundamentaltoimplementtopicssuchandasystem,conceptsandthatalsoarelistlanguagestoolsdrawnsuchupon.asXFormsIntheandfirstserver-sidecategory,scriptingwemaywithoryflowside,database(e.g.clearlyserversPHP)whichallofthe(e.g.followingPostgreSQL).facilitatecommunicationarerelevant:Onthework-the-databases,theory,dataandschemaintegration,distributedandsecurity.views,peer-to-peerinformationsystems,2.1

XForms

ManyformspracticalsolvedasproblemsassociatedwithelectronicmendationbyimplementedthebyhtmlhaverecentlybeenInbytheintroductionoftheXFormsrecom-toolsourwork,weWorlduseXFormsWideWebasconsortiumbutoneof[14].theitssignstrengthstosolvesuchourtechnicalasitsModel-View-Controllerproblem;indeed,weusede-ofaddXMLpattern,output,itsandclient-sidesoon.Importantly,validation,constructionhowever,wegestingmanyversionsnewdesirableavenuesfundamentalofstudyinthefeatures,contextthusoffuturesug-betweenLookingofXForms.

atsomeimportantpracticaldifferencesXForms,weourlistform-basedthefollowinginformationthreeissues:

systemand•DatabasetoButreaddataconnection.fromInXForms,itispossibledesignersthetablesandwritedatatoadatabase.correcttomustalreadyexist,requiringformIncontrast,sqlexpressions.

knowtheschemaandprovidetheinoursystemformdesignersneed

onlyform,tofocusoncreatingtheschemaofandpossiblyre-usingotherformschemas;theirreadwellwriteaccesstoandfromthedatabase,ashandledasprecedingautomatically.

data-definitionstatements,are•Accessregulaterules.stanceaccessIntoXForms,datastoredthereinarethenoXMLrulestodatadatabaseinortheaXMLdatabase.sourceisItaccessible,isassumedthatin-allthetheseformhandlesdesigneraccessmaynotrights.haveInfulltheorcontrollatterthatcase,theoverInplicitourconstraints.

ofpartproposedofsystem,accessrulesareanex-server.

theform’sdesigner,theform’sanddefinition,enforcedunderbythecontrolforms•Workflowamayworkflowmodelling.ThereisalsononotionofvaluesbeenteredprocessinattachedtoXForms;fieldsmayarecalculatedarandomfromothers,order,andalthoughconstraintssomeThereferenceotherfields.

implicitlyaccessruleswerequireinaform’sdefinitionbeimposeanorderinwhichfieldsmayaworkflowassignedprocessvalues.correspondingHenceitispossibletoaform.toinferXForms,Turningtocomplexpressiveowingwenotesomemoretheoreticalissuesw.r.t.tothethatfactthethatrecommendationusershaveaveryisveryex-onlytypedoeslanguageinwhichtodescribeforms.Notguage.system,XFormsitalsouseintroducesthefullpowerarichofXMLconstraintSchema’slan-problemsThiswenesswilltotakesuchexpressivityascompletion.precludesInourfindingongoingdecidablework,allowathedifferentstudyapproach,ofdecidabilitylimitingproblems.expressive-2.2

WorkflowProcesses

Thedersecondaryaccesswhichconditionsaimof(inthisthepaperformisoftoadatainvestigateun-constructrulesdefinition.

aworkflowlanguage)graphitispossiblemodelandcorrespondingtoautomaticallytoaformbeenResearchcommercialactivesinceinthethearealateofeightiesworkflowmodelling[3]hasagementtivesSystemsdevelopment(WfMS)ofandhasledtothe[18].variousTheWorkflowmainMan-cess),haveformation),(2)resourcetraditionally(ororganization),been(1)control(3)flowperspec-data(orpro-(orbeenapplication)(4)taskperspectives(orfunction),[2].Oftenand(5)(orin-theoperationaimvarioustoextendmodellingconceptstobetterhasderivationsubtledetailsoftheseperspectives.Dynamiccaptureattention,oftionareforusingandworkflowprocesseshasnotyetreceivedform-basedconstitutesaverysignificantmotiva-relevantthemainourperspectivecontributioninformationrelatingofsystems,whichtothisworkflowpaper.Themostrecordsettingofotherdataisandthedatadothisperspective,researchinprogressivelyaselectroniconavailabilityforms(constraintsIncontrast,datapreviouslyentered.

etc)oninWorkflowPatterns[5]controlflowweformedfocusismoreontheimportantorderofflowthanprocessing,data-flow.synchronization,Inourcase,followsfromonthem;ofdataandtheoperationsper-thecontrol-flowmoreorlessimplicitlyperHence,actionisaninstanceaworkflowdata-flow.

overcaseainthecontextofthispa-aactionsform,correspondstothecertainentryofform’sdatainschema,apartanofthatandthecanworkflowbeexecutedprocesstoarriveistheatsequenceacorrectly

ofcompleteddataprovidedformbyasthedefinedform’sbydesigner.

theaccessrulesovertheWorkflowsearchMining.Anotherareainworkflowre-cessesrecentlyhasbeentheminingofworkflowpro-actionfromwork,anddiverseeventlogsinformation[4,8].Insourcesthiscase,suchastrans-timedifferentbyworkflowexperts.processesHowever,arethenotasinourfocusmodelledaheadofpletelyfromours,andthetwomethodsissignificantlyarecom-haveFinally,independent.

inourworkflowdiscussedownpreviouswork[16,17],wesentedprocessesformalaremethodstodecidewhentwobasedviewsnon-destructivethesame,andhavealsopre-inworkflowmethodssystems.tointegrateform-2.3

Databases,tribution,andModelling,Views

Integration,Dis-Themostlargestareaofresearchrelevanttothispaperespeciallyobviouslytainrelevant.thatFirstly,ofdatabases.ourformSeveraldefinitionstopicsiscon-aremodellingaschemastronglybasedonentity-relationshipininfactto.Instancesovertheschemascorrespondsenttheseventiesnestedofrelationstheprevious,aconceptcentury.widelyWestudiedrepre-themthemoreasinstancesXMLdocumentsastrees,andanotherwillnormallypopular,serializeifschemasrecent,XMLwilldatabasebeexpressedresearchinaarea.languageLikewise,muchbasedtheisbasedSchema.onasubsetInaddition,ofXPathourcorrespondingaccessruleslanguageontofirstorderlogicrestrictedtotwovariables(FO2).DistributedmationDatabasesandPeer-to-PeerInfor-formsSystems.Acleardesigndecisionforourofsystemhasbeentousethepowerfulnotiondescribingpeer-to-peergroupsmunicatesofusersoneeachcentralizedinformationformssystems.server,Ratherweassumethanstoredaspectatotherwithlocations,peershavetotheirandaccessownaddforms,servertothatobtainwhichcom-data.dataThisiedopensupmanyinterestingtopicsalreadystud-assumeinthecontextofdistributeddatabases.Weshallthesolutionsfromthatfieldratherthanre-inventadditionalwheel.However,tworelatedissuesdeservesomegration.

attention:viewsanddata&schemainte-DatasingleandSchemaIntegration.Bothwithinaandpeerasbetweenvariouspeers,itispossibleentdesirabletoreuseschemasintroducedbydiffer-widelyforms.Schemaintegrationisaverycomplexandtemsities[10,studied11,20,topic21].Ininourthecase,contextsomeofdatabasessys-applicable.areirrelevant,integrationHowever,whilethemainotherresultsofaretheverycomplex-muchtiontotoread-onlyperspective,data.isIndeed,thatdifference,wedon’tlimitfromintegra-adataanreadtointegratedinformationschema,fromwemustallowusersbutvariouswemustpeersrepresentinggrationupdateform-basedconsiderably,thisdata.however,Thisfurtheralsoenablethemthedescriptioncomplicatesofinte-portwritingasimpleinformationdatafromandefficientsystemvarioussources.

procedurewilladequatelyforreadingsup-ourandViews.icallyschemasrelatedOurdatadatamodelstoresacollectionoflog-schemaunderlyingpluspresentinforms.structuredInainrealaccordancesense,eachtoformthedataitsmodel.accessrulesTheisaactsconstraintsasaviewthatonthewe

defineentellingentities.inSectionThe3joinareoperationabletoprojectispartsfromdiffer-selectionofrelationscreatorsisdoneintheschema.presentAndsomeintheformmod-oftheirandmaintenancedisposal,offormswhenapplyingaccessrules.Hence,andhaveanimplicitviewlanguageatappears.

theproblemofviewupdatabilitytypesThedatamodelcanbeimplementedinvariouswillofdatabasesystems;usually,arelationaldbmsstancesbenatively,canusedbebecausetranslatedoureasilynestedtothisrelations-likemodel.Alter-in-befromused.nativeWhenorXML-enableddatabasescanalsoResearchresearcharelationalsystemischosen,resultsderway[19].intointoupdatingrelationalXMLviewsviewscaniscurrentlybeused[12].un-2.4

SecurityandAuthentication

Formsnatesystemscollect,store,retrieveandthatrequired.suchpossiblysystemssensitiveprovideinformation.secureaccessIttoisdataessentialdissemi-whenuesexpressingtobeThethoroughlyareaofstudied.securityhasFormalbeenlanguagesandcontin-forfinedoriented[15,24].securityInourrelationshipswork,wetakehavearatheralsobeende-apreciselyrulelanguageapproachthattosecurity;enablesainformsSectioncreator4wedatabase-describerespondingwhodatadictionarytocanforms.create,oftheThesereadrulesandtodefinewilldeletebepartdataofcor-thedataAreliableauthenticationformssystem.

processtogetherwithtographyencryption,typicallybasedonpublickeycryp-toistheaccessanddigitalrulestocertificates,buildatrulyisneededsecureinsystem.additionItproceduresassumedinformationarethattheseauthenticationandencryptioncurrentsystem,availableandassoaisserviceoutsidetothethescopeform-basedofthestraightforwardAuthenticationwork.

onsingleserversystemsisseamlesslymultipletosystemsoperation.whereExtendingauthenticationaavoidherselfthepeersaction.tosituationisnotsosimple.dataWecertainlyissharedwishacrosstoeverypeerwerethataisuserinvolvedisrequiredinaformstoidentifyatInstead,authenticationshouldbecarriedtrans-outationtheprimaryformsserver,andinter-peernegoti-dataadditionalonshouldotherpropagateappropriateaccessrightstoresearch.servers.Thisproblemasyetrequires3

FormWISDataModel

Weinformationproceedwithdatamodelthatsystemdescribingituses.

(FormWISwhat)is,aform-basedanddefinewebtheForm-basedFormWISpresentsisaWebcooperativeInformationSystem.AAsthatsuchUserscanitallbeoffersdatatotheuserinformationinelectronicsystemwebforms.thatupdatedaviewthroughonthedataunderlyingentryindatathemodelform.dataifcanthisperformisallowedallbymanipulationsthe2accessrulesofthethatpresentedarepartoftheshareUsersdefinitioncanaddofnewaformforms.

thatmayunderlyinginformationwithdatamodelwithispreviouslythenautomaticallydefinedorforms.maynotextendedThetion.thedeterminedTheextraaccessinformationbytherulesuserassociatedinthiswhodefinedtonewthethenewformdefini-form.

dataare2

Thisimpliesthatusersmayhavetoidentifythemselvesbysup-plying,forexample,apassword.Weassumesuchanauthenticationmechanismispresent.

work,AFormWISzationsmakingdatawillsharingcooperatebetweenwithdisparatepeersoveranet-FormWISpossible.tions,isthatWhattheyisallowspecialaanddesirableorgani-aboutsourcesofdataparties,bothcapturingmorenaturalevolu-withinandliberalreuseofinformationwhichwilltypewhileofmaintaininganorganizationstrictrulesandaboutwithwhothirdhasmaticbeanddiscussedaccessdynamicinmodellingSectiontowhich5,data.oftheyaworkflowallowInaddition,forasprocess.auto-3.1

FormalDefinitions

Tomodel,fosteraschemas,wewillclearfirstunderstandingdefineschemasoftheandFormWISinstancesdataoverinstances.beforeturningtotwodifferentsemanticsof3.1.1

SchemasandInstances

AthatFormWISstoresdefinitionsnitionbelongtoaform.Wewillofdeferformstheandformalinstancesdefi-ofseveralaformofaparts.isformitstoSection4,butoneimportantpartWeschema.firstdefineInturn,aframe.

aschemaconsistsofDefinition(C,R,s,t)where

1(Frame)AframeisatupleF=•Centityisaclasses,setofclassandnamesCv,thepartitionedvalueclassesintoCe,the•Rasetofrelationnames

•starget:R→classesCeandofta:relation.R→CgivingthesourceandAingframemulti-graphissaidtoisbeaforest.

aforestframeifthecorrespond-hasnameAuthorNamewritesBookhastitleTitleFigure1:Anexampleofaframe.

Examplewillpublicationbeused1inConsiderthefollowingframeFwhichwhereandC=detailsthecontextCe∪Cforvwithauthors.ofaformCe=Fcapturing=(C,R,bookt,s)hastitleCvs},=and{Name,s(writesTitle)}=.{RAuthor:={writes,{Author,Book}dekeyserhasname,}t{((writeshasname),t)(.hasnameFurthermore,)={Name:s(hastitle},and)=t{Book}==shownTitle}.inAFiguregraphical1.

representationofthis(hastitleframe)=isOnethatofthecentralideasinourworkisthatweargueforelikeseemsformsarenaturalusuallytohierarchicaluseanhierarchicalinnature.Itthere-toshipmodelnestedmany-to-manyrelationsorXML.relationsHowever,datamodelsuchwewillwantmorebetweenEntity-Relationshipeasilydonetheinclassesagraph-basedBookandmodelAuthorasthesuch,relation-whichastheisExchangeModel(OEM).

Model(ERModel)ortheObjectDefinitionaframeF=2(C,(InstanceR,s,t)isofatupleframe)(O,AnIinstanceofC,IR)where

•OandaOsetv,ofvalues

objectspartitionedintoOe,entities,•IsuchC:thatC→I2Otheclasscinterpretation∈CeandIfunctionC(c)⊆OeifC(c󰀅)⊆Ovifc󰀅∈Cv•ItionR:Rosuch→s(that2O×Or))fortheandallrelationo(ointerpretationfunc-1,o2)∈IR(r)itholdsthat1∈IC(2∈IC(t(r)).

Exampleframe2ConsiderthefollowingwhereOvOF=presentedOe∪OvinwithExampleOe={a1:Iinstance=(O,IIofC,IR)1,a2,a3,Furthermore,={knuth,date,b1,b2}andand{{(aI)Iwidom,programming,databases}.C=(Author:{bdekeyser)={a1,a2,a3}C(Book1,b2}.Finally,IR(writes)=1,b1),(a2,b1),(a2,b2)I(a,knuth),(a,(a3,b2)},IR(hasname)=12,date),(a3,widom)},andR(hastitle)={(b1,programming),(b2,databases)}.labelledAninstanceofgraphwhereofaframethenodescanalsoarebelabelledthoughtwithofasaofofthoseclassesarelationship.

classes)(meaningandthatedgesaarenodelabelledisanobjectsetswiththeinnameeachDefinitioninstance(O,E,λ)(where

O,3I(Instancegraph)ThegraphofanC,IR)ofaframe(C,R,s,t)isthetuple•Oisthesetofnodes,

•Elabelled={(oedges1,r,o2)|(o1,o2)∈IR(r)}isthesetof•λλ(:oO)=→{c2C∈theC|onode∈IlabellingfunctionsuchthatC(c)}.

Examplecanbepresented3TheasinstancethegraphformulatedshownininFigureExample2.

2a1a2a3hasnamewriteswriteshasnamehasnameKnuthwritesDatewritesWidomb1b2hastitlehastitleprogrammingdatabasesFigureinforExample2:Anclarity.

1,instancewiththegraphλlabellingforFramefunctionFpresentedomittedWearenowreadytodefinetheschemaofaform.Definition(4(Schema)AstraintsF,K)whereFisaforestframeschemaandisKaatuplesetS=butwewilloverassumeF.Theseherecanthatbetheyanyofcon-aretypeofoftheconstraintfollowingforms:c1isac2,r1isa↓r2andr1isa↑andrrr2withc1,c2∈C1,2∈R.

Thisschemadefinitiondifferentfromframeforms.avarietyallowsustocreateoneconceptualThus,ofaschemaseachbelongingtoTheseconstraintsconsistingofcanonerefertreeform’sschemaisaforesttoclassesplusisaorrelationships

constraints.withinframes.theformsItform’sisonlyframe,whentakingbutalsothetoschemasotherforms’ofemerges;togetherisathissuperthatschemaone,purelyisaconceptual,forestoftreesschemaallwithFigure‘vines’betweenthem.AnexampleisgivenininNote3.

thatitistheinclusionoftationsourtheoreticalfunctionalitytobecomedatapeer-to-peer,modelthattheisaconstraintshenceallowsprovidingimplemen-thedeed,theinFigurealluded3thetoseparateintheschemastitleofthisthatpaper.In-ferentconceptualpeers.superschemamaybepresentmakeondif-up3.1.2

GraphandTree-basedSemantics

Whereasinstancetionisaactuallyform’sschemaagraph.isaClearlytree,athecorrespondingwritesrela-meaningusedinthepreviousexamplesismany-to-many,athatanauthorhaswrittenseveralbooksandcorrespondingbookmaybeureinstancewrittenbyisaseveralgraph,authors.asshownThus,inFig-theaisvarietyHowever,2.

ofreasons.wewouldFirst,likeinstancesbecauseatobetrees,forashierarchical,deringtreesontheweusers’wouldscreens.liketoExactlyrenderform’sitsinstancesschematuallyweoneshouldandindicatethesamethatobjecttwoobjectshowshowntheisren-ac-allowsdon’thapsdatadiscusstohere.Aninstanceisabeingguiaissuetreethatalsofurtherusingandmanipulatedattributebeserializedreferences),asXMLdocuments(per-usinglanguageswhichcanthenbeclearXQuery.notinSectionThe5:mainwithoutreason,hierarchicalhowever,suchasXSLTinstanceswillbecomediagrampossiblecorrespondingtodescribetoindividualtheform’sstatesworkflowintheitismodel.stateToshipsallowandstraints.instances,intheuserspresencetospecifymany-to-manyrelation-wewillofbothhierarchicalschemasschemaSConsider󰀅=(F󰀅,Kthatrequire).ThewehavethemframeasecondtouseF󰀅issimilarformisawhosecon-toF:F󰀅=(C󰀅,R󰀅,s󰀅,t󰀅),C󰀅={Book’,Author’},R󰀅={{writtenAuthor’}},.s󰀅In(written)addition,=the{Book’setK},hasandthet󰀅following(written)isa=constraints:Book󰀅isaBook,Author󰀅isaAuthor,andwrittengiveninisa↑Figurewrites3.

.TheconceptualsuperschemaisAuthorisaisaBook'writeswrittenisaBookAuthor'Figureobtained3:fromAnexampleschemasofSaandconceptualS󰀅.

superschemadefineInthegraphinstances.

thepresencesemanticsofofsuchinstances.isaconstraints,WefirstweturnmusttoDefinitionofFathatschema5satisfiesS(Graph=the(F,constraintsK)Instance)isaninstanceAgraphinstanceinK:(O,IC,IR)of1.ifc1isac2∈KthenIC(c1)⊆IC(c2)2.ifr1isa↓r2∈KthenIR(r1)⊆IR(r2)3.ifr1isa↑r2∈KthenIR(r1)−1⊆IR(r2)

andthefollowingtwogeneralconstraints:

1.disjointnesscifo∈IC(c1)∩IC(c2)c∈Csuchthere∈Iareisapathsfromthencthereisa33toboth1anc2andoC(c3)2.surjectivityifo∈IC(t(r))thenthereisano󰀅

suchthat(o󰀅,o)∈IR(r)

Notedefinition:

1Wemakethefollowingremarksaboutthis•Theiftheseandisjointnessobjectbelongsconstrainttoweusemeansthattheclasseshaveacommontwodistinctsubclassclasses,ofwhichthenmoreobjectdisjointliberalisedgesbetweentherethanalsoashouldrequiringmember.Thisconstraintisthem.benofordirectedtwoclassespathoftoisabe•TherelogicallycanbeimplicitisaconstraintsthatwesumehaveimpliedbythesetK.Inpreviouswork,areautomaticallyinshownthispaperhowtheycanbederived.Weas-whenthataformthisisderivationsubmitted.happens•Towillhaveandassumeasimpleconditionsthereisnothatmultipletherenotionareof“location”ofdataweinheritance.nocyclesofisaedgesfortrueanthereisalwaysauniquehighestUndertheseclassstorageobject,locationwhichofmightthedata.

beconsideredastheExampleasetgraph4TheinstancegraphshowninFigure2isandofsurjectivityisainstanceconstraintssinceconstraintsKforisempty,theprecedingexamplesthearesatisfied.

andthedisjointnesserarchicalAswewillsemantics.

instances,notbeweusingnowgraphturninstances,tothetree-basedbuthi-DefinitionschemaFS=6(F,(TreeK)isInstance)aninstanceA(O,treeIinstanceofathepluslabelledgraphanofequivalencetheinstancerelationC,IR)offrameis≡⊆O×OsuchthatsatisfiesbytheλconstraintswithatmostinKoneaforestandnodesareunderclass,≡:

andmoreover1.ifc1isac2∈KthenIIC≡(c1)⊆IC≡

(c2)where

C≡(c)={[o]≡

|o∈IC(c)}

2.ifr1isa↓r2∈KthenIIR≡(r1)⊆IR≡

(r2)where

R≡(r)={([o1]≡,[o2]≡

)|(o1,o2)∈IR(r)}3.ifr1isa↑r2∈KthenIR≡(r1)−1⊆IR≡

(r2)andthefollowingfourgeneralconstraints:

1.disjointnessoifo1∈IC(c1),o2∈IC(c2)ando1≡o2thenthereisac3∈Cando3∈IC(c3)suchc2≡anoc3andthereIareisapathsfromc3toboth12ando∈C(c3)

2.surjectivityifo∈IC(t(r))thenthereisano󰀅

suchthat(o󰀅,o)∈IR(r)3.duplicate-free(o)∈Iattributes3if(o1,o2)∈IR(r)and1,o3R(r)theno2≡o34.equivalentIthere(s(r)),ocommonoattributes4ifo1,o2∈C1≡2and(o1,o3)∈IR(ois)∈anIothato(r)then4∈Osuch3≡o4and1,o4R(r)

semanticsItisimportanttounderstandandandthetreesemantics(1)arewhynotequivalent,thegraphthisgivenpaper.(2)whythisisnotimportantinthecontextofwhenHowever,wehavedefinedthereasonstheaccessforthisrules.

canonlybe3

Everyequivalenceclassappearsonlyonceinattribute.

4Equivalentnodeshavethesamesetofequivalenceclassesincommonattributes.

a1a2a3hasnamewriteswriteshasnamehasnameKnuthwritesDatewritesWidomb1b1'b2b2'hastitlehastitlehastitlehastitleprogrammingprogramming'databasesdatabases'Figureinstance4:shownAtreeininstanceFigurecorresponding2.

tothegraph4AccessRules

Wesystem.havetoUpnowtodefinednowaformthedatahasmodelfortheformsspond.whichnowmakebeThisanumberahierarchicalschemashownmeansinstancesthatofhierarchicalusersinstancescorre-oftheaccessingform,andaformcanalsocanbeinstance.ablechangestoWespecifytothewilldescribeaccessinstance.rulesHowever,weneedtosuchtoruleseachinobjectthissection.inthe4.1

ActionsonData

Usersofoftheformssystemwillwanttodoanumberseethingsittheinstanceswithit.Firstly,theywanttoopenaformtostancesshouldbepossiblethattoarerestrictassociateduserswithtoseeit.Clearly,form’sinformationdesigner.theyareSecondly,entitledtosee,asdefinedonlybythein-anintheform,eithertheybywillchangingwanttovaluesupdateintogether.

existinginstance,orbycreatinganewinstanceallpresentAgoodexampleisthewantentitledtoinseeourdepartment.paperUserssubmissionoftheformformwillchangetosee.thoseTheydetailswillofalsoallpaperswantthattheyarewhichthetitleofapaper,butonlyiftoit’sbeabletoableofit.

totheyaddaarenewanpaperauthor.aslongLikewise,astheytheyaareshouldpaperanauthorbeoftoThespecifyInoursystem,accessrightswewilltiedallowtothethedesignerofaformtheaccessrulesintheschemawillschemabeevaluatedoftheform.overinaccessible.

thecorrespondinginstancewhereinstances,therulesandareonlysatisfiedthoseobjectswillbeCRUD.date,onlybecausetheDelete)OftheC,R,rulesusualandusedCRUDDrightsforaccessing(Create,Read,Up-willbeneeded.dataobjects,Thisismodel,makingandouredgesruleswillhavebenotiedpropertiestoedgesofintheirtheown,datatheanupdateofanedgemeaningless.Updatinganpreviousedgevalueandofacreatingpropertyanewofaclassinvolvesremovingtions:asedgeswork[13],wewillonlyone.considerFurthermore,leafopera-asin(suchleafsinthecantree.becreatedLargeroroperationsdeletediftheyappearleafoperations.

asamove)canbesimulatedbyaonsequencethetreeofNotebetweenthatisstoreddifferentthereisatauniquepeers,noneedlocationasforeachpropagationofupdatesandindividualpeersthatdatauseitemit

mustobtainitfromthislocation1usedHandling.

sumeacrossdifferentupdatesonformschemaswhentheyareaffectedthatusers.insuchinstancespeersisanotherthesystemmatter.willWenotifyas-4.2

AccessRuleLanguageandForms

AsisbasedmentionedonainlimitedSectionsubset2,ourofaccessXPathrulecorrespond-languageingtax,tobutexcludingincludingFO2.Specifically,conditionswethedescendent-or-selfcontaininguseXPath’spathsurfacesyn-axisexpressions,(denotedas//than).Aswayssemi-structuredourinstancesresemblenestedrelationsmorenecessary.

fixedintheschema,data,thusthemakingnestingthisdepthaxisisun-al-meaningThepathinvariablesacomparisonthatexpressionsexistenceofcantheend-nodebeusedonischecked,theirown,orexpressionsuseridtocanbe,dateaconstantcombined,andtimeoroneusing.andInofaddition,threesystem,or,andpathnot.Definition(eC,R,s,t),an7(AccessaccessruleRule)isatupleGiven(e,ao,framerF=access∈R,ruleoacreateexpression.

,read,ordeleteoperation,)withandedgeranThus,oftionaschemaaccessandrulesindicateareattachedthattoedgesintheframesionmayoverevaluatesbeperformedtotrue.whentheoperationinques-Anaccesstheaccessruleexpres-longingeachstartstoinstanceaschema.treeEvaluationoftheforestruleisevaluatedofofinstancesbe-theclassfromfromthewhichnodeedgeintheapathexpressionetreethatcorrespondstoveryNotethatthisdefinitiondepartsofanintheschema.isfine-grainedsecurityprovisions.accessIndeed,ruleaccessallowingregulatedcapturedthedesignertotheoflevelaformoffullindividualcontrolattributes,overhowdatagiv-re-usepartthroughofherherschema,form,isbutused.

alsootherformsthatDefinitionS8(Form)andisAaisschemaasetofwithaccessaframeAformrules.

Fisthatatupleisa(S,singleA)wheretree,Theanotionofaformistheconstraintsformrepresentswithandasetatree-likecentralideainthispaper:ofdatamodelwithisamayrulesaccessaforestandofedittreeaccessrules,andcorrespondstheinstancesoveritsschema.Usersmaybearesharedsatisfied.instancesaslongastheaccessoverIndividualvariousforms.

objectsintheinstancesAtheComprehensivebeuresolvedreal-lifeExample.WenowshowhowinexampleourdescribedintheIntroductioncanthe5correspondingLeavegivesApplicationagraphicalforms-basedrepresentationinformationsystem.Fig-form.Aoftheschemaofthatbothweusetheaccessabbreviationrulesisgivennon-exhaustiveUasinaFigureshorthand6.listNoteofforleaveRulecreateanddeleterules.

thatapplications(1)meansthatuserscanonlycreatenewforseetheusersDeancanandonlyforthemselves.Rule(2)meanstheseetheirownapplications,exceptapplicationsallapplications.applicationcanonlyTheHeadofDepartment,whocanbebeginandenddatesforleaveonlyprovediftheitis,asstatedchangedbyrulesby(3)theanduser(4),whoseandtheHeadapplication.ofDepartmentRule(5)hasindicatesnotalreadythatonly

ap-1

Ofcourse,forefficiencyreasons,anactualimplementationmaychoosetopropagateupdatesinstead;ourmodeldoesn’tnecessitatethisbutdoesallowit.

namenfuiduodobStafflisapFacultydisaDept.hDeanbbdateeLeaveApprreadyxhodOKyHoDedatedeanOKFigure5:TheSchemaoftheLeaveApplicationForm.

(l,C,./uid=userid)

(l,R,./uid=userid∨./f/d/uid=userid∨./p/h/uid=userid)

(b,U,../uid=userid∧not(./hodOK))(e,U,../uid=userid∧not(./hodOK))(x,U,./ready∧../p/h/uid=userid)(y,U,./hodOK∧../f/d/uid=userid)

Figure6:SomeaccessrulesfortheLeaveApplicationForm.

theHeadofDepartmentcansetthehodOKattributetotrue,andonlyiftheuserhasindicatedthatherapplicationisready.Hence,thesystemcanautomat-icallynotifytheHeadofDepartmentthathisinputissought,whenrule(5)issatisfied.Thisillustrateshowcontrol-flowisderivedfromtheaccessrules.Finally,rule(6)saysthattheDeancanapprovetheapplica-tionwhentheHeadofDepartmenthasalreadydoneso.

Thedefinitionofaformindicatesthatitistheform’screator(orowner)thatsetsuptheaccessrulesforindividualdataitemsdescribedintheform’sschema.Whenanotherpersoncreatesanewformthatre-usesallorpartoftheoriginalform’sschema,theoriginalaccessrulesstillapply,inadditiontoanynewaccessrulesdefinedbythenewform.Togiveanexample,supposetheaboveLeaveApplicationformwascreatedbytheFaculty,buttheHeadofDepart-mentwantstocaptureadditionaldataifhisstaffareapplyingforleave(e.g.hewantsthemtosupplyareason).Hisnewformwillre-usetheoriginalform’sschemaandaccessrules,andinadditionhecanaddrules.Allrulesmustbesatisfiedbeforetheoperationcanproceed.IftheHoDwantstheoriginalrulestobemodified,hewillneedtonegotiatewiththeowneroftheformthatfirstdefinedtherule.Wearguethatthispreciselycapturesreal-lifedynamicswithinanorga-nization,makingsignificantlyliberatedcaptureandre-useofdatapossiblewhilemaintainingthehighestlevelofsecurity.4.3

InformationLeakage

(1)(2)(3)(4)(5)(6)

specifiesthattheclassC2maybereadifC1.a=x(whereaissomeattributeofC1andxisavaluefora).Alice(andothers)cannowinferthethevalueofC1.abyattemptingtomodifyC2,whichisagainsttheaccessrulespecifiedbyBob.

Asimpleaccessruleevaluatorwillhenceallowin-formationleakageincertaincases.Asomewhatnaivesolutionwouldbetodecreethataccessrulesmayonlybeevaluatedoverpartsoftheinstancetreethattheusermaysee.However,thisiscircularasnowvisibil-itymaybecomedependentonvisibility.

Itseemsthatinformationleakage,however,isadecidablepropertyofasetofaccessrules.Hence,apracticalsolutiontothispotentialsecurityconcernistochecknewlysubmittedformswiththeiraccessrulesandrejectthosethattestpositivefortheinformationleakageproperty.5

WorkflowProcesses

Whiletheaccessruleslanguagewepresentedprovidesaverypowerfulyetelegantmethodtoconstrainac-cess,themethodisnotwatertight.Considerthefol-lowingscenario:formdesignerBobcreatesaclassC1andspecifiesthatonlyhecanreadit.NowsupposeasecondpersonAlicecreatesaformwithaclassC2and

Itisclearthattheaccessrulesnotonlyregulatewhocanseeandupdatewhichpartoftheinstance,butalsothattheserulesimposeanorderonupdates.Hence,itwouldbeveryusefulifoursystemcouldautomaticallyderivetheworkflowprocessassociatedtothisform.Weinvestigatethisinapreliminarymannerinthissection.

Thereasonwhyweincludethisratherinformaldiscussioninthispaperistwofold:firstly,automaticderivationofworkflowprocessesisoneofthemainmotivationsforintroducingform-basedinformationsystems.Secondly,thesectionwillshowthattherearesomehighlyinteresting,non-trivialresearchprob-lemstobefoundinthistopic.Thisisthesec-ondarycontributionofthispaper,andmayperhapsinformthedirectionofcontinuedresearchassociatedtoXForms.

Theleaveapplicationformdetailedintheprevious

U:bU:eC:sU:r+U:x-U:x+U:y-U:y+Figure7:TheLeaveApplicationWorkflowProcess.

sectionflowusuallyprocess.illustratesInthatworkflowaformliterature,correspondsprocessestoawork-oftenniteusingmodelledPetrinetsusing[1,finite23].statemachinesormoreareoneshowscanstateWewillfirstexaminefi-bemachines,derivedautomaticallyattemptingtoforestablishaform.Figurewhether7tionsafinitestatemachine(excludingsometransi-oftheforleavesimplicity)applicationmodellingformshowntheworkflowinFigureprocess5.

theStatestheworkflowcorrespondprocess.toTheyseparaterepresentsteps(oraninstanceactions)ininstanceformrepresentsatacertainatime.AspecificupdateoftheofofThesentedtheoperationtransitionsperformedaretransitionlabelledtoanotherstate.onwithanabbreviationexample,bytrueation(minusU:x+thestartingtheinstancerepre-meaningmeansstateofthetransition.Forfalseanupdate),whileofC:sedgemeansxwithvalueclass.

ofanewedgestoanewobjectoftheLeaveAppthecre-entImportantly,theendstatesmaytheFSMexist.inForFigure7showsthatdiffer-formuladefinitionofaFormtoincludethispurpose,acompletedweextendformdescribes,expressedcreator‘completion’intheendaccessstates;rulei.e.,language,statesthatwhichthepletionsoftheformhasindicatedarecanAninterestingoftheform.

acceptablecom-nitewerepresentresearchaform’squestionworkflowcanprocessnowbeusingposed:fi-tionstatestatesmachinesisdecidable?suchthatreachabilityofcomple-5.1

CanonicalInstances

Theinginstancesafirstfiniteproblemrepresentationweneedoftosolveisthatoffind-berisofinstancesthatmayisinfinitecorrespondtheeventoinfinitewhenaform.numberonlyThestructurenum-ofaconcernedandspecificvaluesaredisregarded,sincehaverelationshipbetweentwoclassesinaschemaureamany-to-manyparticipationconstraint.mayFig-ing8showssomeinstancesforasimpleframetionFigurerelationshipsaandb.

involv-equivalencetheset8ofalsoinfiniteillustratesinstancesthatitispossibletoparti-Fromleasttheperspectiveclasses,whichoftheweaccesscallintocanonicalafinitenumberrulelanguageinstancesof(at.thatparecheckwhenconsideringonlyunarypathexpressionsindistinguishablevalues)whethereachmemberanodeofexistsacanonicalbutdoesinstancenotcom-isinstancesIntheexample,fromcanonicalanotherinstancemember.

Irepresentsalledgeinstancesunderinit).whichCanonicalnoaedgeinstanceexists(andIIhencenobthemrepresentshaveinwhichatleastoneaexists,representsbutnoneallofeachthoseabchild.thathaveTheatthirdleastcanonicaloneaedge,instanceIVleastcontainsofthemoneofinstanceshasabedge.andthosehasthatFinally,canonicalinstanceabchild.

haveatleastonea,andatTheoremtreenumberinstances1(CanonicalofcanonicalofaformInstances)Thesetofallinstances.

canbepartitionedintoafiniteClearlynumberitisstateofcanonicalveryimportantinstances,thatsincewenowhaveafiniteinvolvesmachineton.

findingrepresentingafinitesetaofform’sstatesworkflowfindingafortheautoma-processfiniteforNotethatwecanonlycreatewhytreewewepresentedinstances,notforgraphcanonicalinstances.instancesThatisinstances.

havetousethebothtreeinstancesinSectioninstead3,andofstatedthegraphthatisUnfortunately,afinitesetofstatesfortheinstancesnotsufficient.resenttransitionsadditiongoingleftConsideroperationstorightthattransitionsbetweenFSMthatinFigureaddan8’satopedge,rowrep-tionsfromofofcanonicalsuchinedges.theoppositeinstanceTheproblemdirectionrepresentwhiledele-IItoIalsoisthatinvolvesthetransitionatothe‘last’aremaininginII.WerequirethesedeletioncasesXPath-basedbeintwodifferenttweenaccessrulecanonicallanguageinstances,candistinguishbecauseourtoinstance,determinethetwo(e.g./a).Hence,werequirecountingbe-orresultsifatransitioninanotherstayscanonicalwithininstance.acanonicalstancesTheconclusiontransitionsastheflowofthestatesisthatwecannotusecanonicalin-FSMandthatupdateistorepresentoperationsastheeredprocessdoUnfortunately,someusingofaform.Thereforewebrieflytheconsid-work-countingPetrinetsusingbecausedifferenttheytokenshavetheabilitytosaryreachabilitytoperformuseofinhibitorarcs[9]provedinsideplacesneces-.undecidable.thecountingweneed,thusmaking5.2

Decidability

Thereachabilityproblemsofoutlinedcompletionabovestatesindicateisundecidable.thatcheckingTheoremschema,2(Undecidability)itaccessrules,andacompletedGivenformaformformula,withareached.

isundecidablewhetheracompletionstatecanbeThetomaton,proofinvolvesreductionnumbers,aFSMwithtworegisterstothethattwo-countercontainwholeau-containregisters.0.andTransitionsthatcanincrementcheckwhetherordecrementtheregistersTuring-complete.ItiswellingWeknowncansimulatethattwo-countersthetheareforexampleedgesinnotinstances,(a).

andcheckfor0byregistersexpressingus-orOnepositiveresultsofar,involvesdead-endstates,more.instancesway:asDead-endsofastatesthatareformshouldusuallythatcannotbechangedany-notinterpretedbereachedinbecauseanegativethe

aaa...II

IababaIIIabbIV......Figure8:(Canonical)Instancesoverasimpleschema.Someedgelabelsomittedforclarity.

systemthenentersadeadlock.However,itmaybethecasethatacompletedformformuladescribesasituationinwhichdatainaformshouldnotbeup-datablewhensomeflaghasbeenset.Notupdatablemeansthatit’sadead-endstate,butonethatrepre-sentsavalid,correctlycompletedform.AnexampleiswheretheDeanhasapprovedaleaveapplication,afterwhichnothinginitcanbechangedanymore.Inthissense,determiningdead-endsisveryworthwhile,helpingthedesigneroftheformtoverifytheruleshesuppliedwiththeform.

Theorem3(Dead-Ends)Givenaformincludingaschemaandaccessrules,andaninstancetreeovertheschema,itisdecidablewhethertheinstancecanbeupdated.

Thisresultisduetoouraccessruleslanguagecon-formingtoFO2,whichisadecidablesubsetofFirstOrderlogicusingonlytwovariables.

Unfortunately,becauseoftheundecidabilityofgeneralreachibility,wecannotprovethatthedead-endswefoundwerereachableinthefirstplace,mak-ingthisresultsomewhatlesspractical.

Toendourexaminationofthesecondaryaimofthiswork,i.e.,underwhichcircumstanceswoulditbepos-sibletoautomaticallyconstructaworkflowprocessfromaformdefinition,weoffertheconjecturethatapositiveresultmaybefoundwhenaslightlyweakeraccessruleslanguageisused.

Conjecture1(Decidability)Givenaformwithaschema,accessrulesovertheproposedXPathsubsetwithoutnegation,andacompletedformformula,itisdecidablewhetheracompletionstatecanbereached.6

Conclusion,Implementations,andFutureWork

otherschemas,bothonthesamepeerandonotherpeers.Thisre-useisdoneviaisarelationships.Withaschemacorrespondsaninstanceintheformofagraph.Toallowtheaccessrulestotraverseupwardstojustoneparentofanode,theinstanceisshred-dedintoaforestoftrees.Theaccessrulesimposeanimplicitorderfordataentryinthecorrespondingform,enablingustocheckwhetheraworkflowgraphcanbeconstructed,andtofindspecificstatesintheworkflow.FutureWork

Wearecurrentlyrefiningthedatamodelwepresentedinthispaper,andareinvestigating,giventhatdatamodel,whatsubsetsoftherulelanguagedoallowdecidabilitywhilestillmaintainingapracticallevelofexpressiveness.

Wewillalsoconstructarigorousproof,basedonourcurrentsketch,thattheinformationleakageprop-ertywepresentedinSection4.3isdecidable.Implementation

Onapracticallevel,wehavealreadyimplementedafirstprototypeofverylimitedabilities[6]andarestartingworkonasecondprototypethatimplementsmostoftheideaspresentedinthispaper.Manyprac-ticalissues,suchasuserinterfacedesign,willnotbedealtwithinthissecondprototypeandwillrequireadditionalresearch.

ThesecondprototypeisbuiltaroundasubstantiallyalteredversionoftheDocumentObjectModelasim-plementedinJavabytheXercesApacheproject.Itiscurrentlyastand-aloneformsserverthatacceptsrequestsandupdatesandreturnsaforminstancere-strictedbyapplyingtherelevantaccessrights.Ex-tendingittoenablepeer-to-peercommunicationisbeingplanned.

Derivationofworkflowprocessesisnotyetconsideredinthesecondprototype.Thisisthemaingoalofourthirdprototype,concurrentlybeingplanned.Heredataisstoredinarelationalback-end,andaveryre-strictedaccessruleslanguageisoffered.Akeydesign

Conclusion.Wehavepresentedaformalmodelforaform-basedpeer-ro-peerwebinformationsystem.Themodelincludesadefinitionforformsthatin-corporateaschemaextendedwithaccessrules.Aschemamaybeconstructedbyre-usingelementsfrom

issuetherelationalishowtodatabase.pushthecheckingofaccessrulestoAcknowledgement

WeinsightswouldliketothankToonCalderspaper,inthedecidabilityproblemdescribedforsharinginthishissecurityandissues.HuaWangforvaluablediscussionsaboutReferences

[1]W.agementvanderWorkshopSoftware.Aalst:Petri-net-basedInProceedingsWorkflowoftheMan-NFSinInformationonWorkflowSystems,andpp114–118,ProcessAutomationMay1996.[2]W.J.ProceedingsWainer:vandeWorkflowAalst,P.ofCoopIS’00,ModelingBarthelmess,pp.198–209,usingC.Proclets.Ellis,and

2000.In[3]W.agement:vanderPress,2001.Models,AalstandMethodsK.vanHee:andWorkflowSystems.Man-MIT[4]W.WorkflowvanderAalst,A.Weijters,fromedgeEventMining:andL.Maruster:

Logs.IEEEDiscoveringTransactionsProcessonModelsKnowl-16(9),andpagesData1128-1142,Engineering2004.(TKDE),volume[5]W.puszewski,vanderAalst,A.terHofstede,TechnicalandTechnology.ReportA.Barros:B.Kie-EindhovenWorkflowUniversityPatterns.ofpatterns/documentation.htmhttp://is.tm.tue.nl/research/,2002.[6]R.systemAddie:FormsFree–versitydevelopmentanduseasecureofon-linebutforms.accessible

DecemberofSouthern2004.QueenslandTechnicalReport,Uni-[7]Advantys:

2004.

http://www.workflowgen.com/en/,

[8]R.MiningAgrawal,D.Gunopulos,andF.Leymann:

ture1998.NotesprocessinComputermodelsfromScience,workflow1377:469498,logs.Lec-[9]N.hibitorBusi:AnalysisissuesinPetrinets2,pp.127–177,arcs.Theoretical2002.ComputerSciencewith,275:1-in-[10]Rosati:D.Calvanese,G.DeGiacomo,M.Lenzerini,R.

Integration.Logical251,2004.InProceedingsFoundationsofofPODS’04:Peer-To-Peerpp.Data241–[11]Rosati,D.Calvanese,G.DeGiacomo,M.Lenzerini,to-PeerG.pp.144–157,DataVetere:Hyper:AFrameworkforPeer-R.

2004.IntegrationonGrids.ICSNW’04:[12]datesS.Cosmadakis,31(4):742–760,onrelationaland1984.views.C.JournalPapadimitriou:oftheACM,Up-[13]TransactionS.Dekeyser,J.Hidders,andJ.Paredaens:A

WideWebJournal,Model7(1):forXML29–57,Databases.Kluwer,2004.World[14]man:M.Dubinko,L.Klotz,R.Merrick,andT.V.(W3C)XFormsRecommendation,1.0.WorldWideRa-OctoberWeb2003.

Consortium[15]AJ.actionslogicGlasgow,forreasoningG.MacEwen,aboutandP.Panangaden:

Auguston1992.ComputerSystemssecurity.10(3),ACMpp226–264,Trans-[16]Hofstede,J.Hidders,ProcessesandM.J.Dumas,Verelst:W.WhenvanaredertwoAalst,WorkflowA.ter

TheorySymposiumthesame?(CATS’05),Computing:2005.theAustralian[17]K.J.basedvanHidders,J.Paredaens,P.Thiran,G-JHouben,

Views.Hee:Non-destructiveInProceedingsIntegrationofADBIS’05,ofForm-2005.[18]tion:D.Hollingsworth:WorkflowManagementCoali-On.TechnicalTheWorkflowReport,ReferenceFebruaryModel2004.TenYears[19]eta:H.Kozankiewicz,ADBIS’03,UpdatableJ.Leszczylowski,andK.Subi-LNCSXML2798,Views.2003.InProceedingsof[20]YouM.Lenzerini:Data22-26,Thought.IntegrationIsHarderthan

2001.InProceedingsofCoopIS’01:pp.[21]Perspective.M.Lenzerini:246,2002.InProceedingsDataIntegration:ofPODS’02:ATheoretical

pp.233–[22]TheMicrosoft:managementMicrosoftInfoPathOffice2003informationProductgatheringInformation:

andcom/office/infopath/prodinfo/trial.mspxprogram.http://www.microsoft.2004.,[23]Applications.T.Murata:PetriNets:580,April1989.ProceedingsProperties,oftheIEEE,Analysis77(4):541–and

[24]AbstractS.Nanchen11thStateandMachines.R.Stark:InASecurityLogicfor

MachinesInternational’04.LNCSWorkshopProceedings3052,2004.

onAbstractofStatethe