Model-based Security Engineering of SOA System Using Security Intent DSL

• Main Authors: Saleem, M. Q., Jaafar, J., Hassan, M.F.
• Format: Citation Index Journal
• Published: The Society of Digital Information and Wireless Communications 2011
• Subjects: QA76 Computer software
• Online Access: http://eprints.utp.edu.my/6393/1/vol01_no02_55.pdf; http://www.sdiwc.net/ijncaa/index.php; http://eprints.utp.edu.my/6393/

Currently most of the enterprises are using SOA and web services technologies to build their web information system. They are using MDA principles for design and development of WIS and using UML as a modelling language for business process modelling. Along with the increased connectivity in SOA environment, security risks rise exponentially. Security is not defined during the early phases of development and left onto developer. Properly configuring security requirements in SOA applications is quite difficult for developers because they are not security experts. Furthermore SOA security is cross-domain and all required information are not available at downstream phases. Furthermore, business process expert; who is the actual stakeholder of the business process model is unable to specify security objectives due to lake of security modelling elements in a general purpose modelling languages like UML. As a result, business process expert either ignore the security intents in their model or indicate them in textual way. A security intents DSL is presented as a UML profile where security intents can be modelled as stereotypes on UML modelling elements during the business process modelling. Aim is to facilitate the business process expert in modelling the security requirements along the business process modelling. This security annotated business process model will facilitate the architectural team in specifying the concrete security implementation. As a proof of work we apply our approach to a typical on-line flight booking system business process.