Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben
Software and Systems Modeling
Erschienen in: Software and Systems Modeling 2/2014

01.05.2014 | Theme Section Paper

Modeling and enforcing secure object flows in process-driven SOAs: an integrated model-driven approach

verfasst von: Bernhard Hoisl, Stefan Sobernig, Mark Strembeck

Erschienen in: Software and Systems Modeling | Ausgabe 2/2014

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

In this paper, we present an integrated model-driven approach for the specification and the enforcement of secure object flows in process-driven service-oriented architectures (SOA). In this context, a secure object flow ensures the confidentiality and the integrity of important objects (such as business contracts or electronic patient records) that are passed between different participants in SOA-based business processes. We specify a formal and generic metamodel for secure object flows that can be used to extend arbitrary process modeling languages. To demonstrate our approach, we present a UML extension for secure object flows. Moreover, we describe how platform-independent models are mapped to platform-specific software artifacts via automated model transformations. In addition, we give a detailed description of how we integrated our approach with the Eclipse modeling tools.
Vorheriger Artikel Model-driven engineering of middleware-based ubiquitous services
Nächster Artikel Security modeling for service-oriented systems using security pattern refinement approach

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Jetzt informieren
Anhänge
Nur mit Berechtigung zugänglich
Fußnoten
1
For the sake of simplicity, Figs. 3 and 4 show only two incoming/outgoing flows for the respective control nodes. However, the corresponding discussion equally applies to an arbitrary number of incoming/outgoing edges, of course.
 
2
For some of our OCL constraints, Appendix A provides two optional OCL statements expressing identical constraints, where each of these optional constraints complies with a different version of the OCL standard. OCL Constraints 4a and 6a comply with OCL version 2.2 [56], while OCL Constraints 4b and 6b use new language constructs from the OCL 2.3.1 standard [57]. The changes affect only the allSuccessors() and allPredecessors() definitions which are interchangeable.
 
3
For example, an alternative visualization of SecureObjectFlows attributes would use comments/constraints attached to secure object nodes directly in an activity diagram.
 
4
Note, however, that we only make these assumptions to simplify the following explanations, our approach is independent of these assumptions, of course.
 
5
Note that such “choreography roles” do only model which participant provides and/or requests specific functions/interfaces. They do not model access control roles. For the definition of process-related access control models, the SecureObjectFlows extension is integrated with the extension presented in [85].
 
6
All modeling and implementation artifacts are available from http://​nm.​wu.​ac.​at/​modsec.
 
7
This constraint conforms to the OCL standard version 2.2 [56].
 
8
This constraint conforms to the OCL standard version 2.3.1 [57].
 
9
This constraint conforms to the OCL standard version 2.2 [56].
 
10
This constraint conforms to the OCL standard version 2.3.1 [57].
 
11
Here, an OCL 2.3.1 compliant definition is omitted. For an OCL 2.3.1 compliant definition of allPredecessors() see OCL Constraint 6b in Appendix  A.
 
12
Here, an OCL 2.3.1 compliant definition is omitted. For an OCL 2.3.1 compliant definition of allPredecessors() see OCL Constraint 6b in Appendix A.
 
13
Here, an OCL 2.3.1 compliant definition is omitted. For an OCL 2.3.1 compliant definition of allSuccessors() see OCL Constraint 4b in Appendix A.
 
Literatur
1.
2.
3.
4.
Axenath, B., Kindler, E., Rubin, V.: AMFIBIA: a meta-model for the integration of business process modelling aspects. In: Leymann, F., Reisig, W., Thatte, S., van der Aalst, W. (eds.) The Role of Business Processes in Service Oriented Architectures, Dagstuhl Seminar Proceedings (2006)
5.
Basin, D., Doser, J., Lodderstedt, T.: Model driven security: from UML models to access control infrastructures. ACM Transact. Softw. Eng. Methodol. (TOSEM) 15(1), 39–91 (2006)CrossRef
6.
Baumgrass, A., Baier, T., Mendling, J., Strembeck, M.: Conformance checking of RBAC policies in process-aware information systems. In: Proceedings of the Workshop on Workflow Security Audit and Certification (WfSAC), Lecture Notes in Business Information Processing (LNBIP), vol. 100. Springer, Berlin (2011)
7.
Cannon, J., Byers, M.: Compliance deconstructed. ACM Queue 4(7), 30–37 (2006)CrossRef
8.
9.
Damianides, M.: How does SOX change IT? J. Corp. Account. Finance 15(6), 35–41 (2004)CrossRef
10.
11.
12.
13.
Elvesæter, B., Berre, A.-J., Sadovykh, A.: Specifying services using the service oriented architecture modeling language (SoaML)—a baseline for specification of cloud-based services. In: Proceedings of the 1st International Conference on Cloud Computing and Services Science (CLOSER’11), pp. 276–285. SciTePress (2011)
14.
Elvesæter, B., Carrez, C., Mohagheghi, P., Berre, A.-J., Johnsen, S., Solberg, A.: Model-driven service engineering with SoaML. In: Service Engineering—European Research Results, pp. 25–54. Springer, Berlin (2011)
15.
Fink, T., Koch, M., Pauls, K.: An MDA approach to access control specifications using MOF and UML profiles. In: Electronic Notes in Theoretical Computer Science, pp. 161–179 (2006)
16.
17.
18.
19.
Foster, H., Gönczy, L., Koch, N., Mayer, P., Montangero, C., Varró, D. UML extensions for service-oriented systems. In: Wirsing, M., Hölzl, M. (eds.) Rigorous Software Engineering for Service-Oriented Systems, Lecture Notes in Computer Science (LNCS), pp. 35–60. Springer, Berlin (2011)
20.
Gilmore, S., Gönczy, L., Koch, N., Mayer, P., Tribastone, M., Varró, D.: Non-functional properties in the model-driven development of service-oriented systems. Softw. Syst. Model. 10(3), 287–311 (2011)CrossRef
21.
Hafner, M., Alam, M., Breu, R.: Towards a MOF/QVT-based domain architecture for model driven security. In: Proceedings of the 9th International Conference on Model Driven Engineering Languages and Systems (MODELS 2006), Lecture Notes in Computer Science (LNCS), pp. 275–290. Springer, Berlin (2006)
22.
Hafner, M., Breu, R.: Security Engineering for Service-Oriented Architectures, 1st edn. Springer, Berlin (2009)
23.
Hafner, M., Breu, R., Agreiter, B., Nowak, A.: SECTET: an extensible framework for the realization of secure inter-organizational workflows. Internet Res. 16(5), 491–506 (2006)CrossRef
24.
Hafner, M., Memon, M., Alam, M.: Modeling and enforcing advanced access control policies in healthcare systems with SECTET. In: Giese, H. (ed.) Models in Software Engineering, pp. 132–144. Springer, Berlin (2008)
25.
Hentrich, C., Zdun, U.: A pattern language for process execution and integration design in service-oriented architectures. In: Noble, J., Johnson, R. (eds.) Transactions on Pattern Languages of Programming I, Lecture Notes in Computer Science (LNCS), pp. 136–191. Springer, Berlin (2009)
26.
Hoisl, B., Sobernig, S.: Integrity and confidentiality annotations for service interfaces in SoaML models. In: Proceedings of the International Workshop on Security Aspects of Process-aware Information Systems (SAPAIS2011), pp. 673–679. IEEE (2011)
27.
Hoisl, B., Strembeck, M.: Modeling support for confidentiality and integrity of object flows in activity models. In: Proceedings of the 14th International Conference on Business Information Systems (BIS2011), Lecture Notes in Business Information Processing (LNBIP), pp. 278–289. Springer, Berlin (2011)
28.
Hoisl, B., Strembeck, M.: A UML extension for the model-driven specification of audit rules. In: Proceedings of the 2nd International Workshop on Information Systems Security Engineering (WISSE), Lecture Notes in Business Information Processing (LNBIP). Springer, Berlin (2012)
29.
Huhns, M., Singh, M.: Service-oriented computing: key concepts and principles. IEEE Internet Comput. 9, 75–81 (2005)CrossRef
30.
Hummer, W., Gaubatz, P., Strembeck, M., Zdun, U., Dustdar, S.: An integrated approach for identity and access management in a SOA context. In: Proceedings of the 16th ACM Symposium on Access Control Models and Technologies (SACMAT) (2011)
31.
Jensen, M., Feja, S.: A security modeling approach for web-service-based business processes. In: Proceedings of the 16th Annual IEEE International Conference and Workshop on the Engineering of Computer Based Systems, pp. 340–347. IEEE (2009)
32.
Jürjens, J.: UMLsec: extending UML for secure systems development. In: Proceedings of the 5th International Conference on The Unified Modeling Language, pp. 412–425. Springer, Berlin (2002)
33.
Jürjens, J.: Secure Systems Development with UML. Springer, Berlin (2005)
34.
Kim, S., Burger, D., Carrington, D.: An MDA approach towards integrating formal and informal modeling languages. In: Proceedings of the International Symposium of Formal Methods Europe, Lecture Notes in Computer Science (LNCS), vol. 3582, pp. 448–464. Springer, Berlin (2005)
35.
Kopp, O., Martin, D., Wutke, D., Leymann, F.: The difference between graph-based and block-structured business process modelling languages. Enterp. Model. Inf. Syst. 4(1), 3–13 (2009)
36.
37.
Mayer, P.: MDD4SOA—model-driven development for service-oriented architectures. PhD thesis, Ludwig Maximilian University of Munich, Faculty of Mathematics, Computer Science and Statistics (2010)
38.
39.
Mayer, P., Schröder, A., Koch, N.: MDD4SOA: model-driven service orchestration. In: Proceedings of the 12th International IEEE Enterprise Distributed Object Computing Conference, pp. 203–212. IEEE (2008)
40.
Memon, M., Hafner, M., Breu, R.: SECTISSIMO: a platform-independent framework for security services. In: Proceedings of the Modeling Security Workshop in Association with MODELS 2008 (2008)
41.
Mendling, J., Lassen, K., Zdun, U.: On the transformation of control flow between block-oriented and graph-oriented process modeling languages. Int. J. Business Process Integr. Manag. 3(2), 96–108 (2008)CrossRef
42.
Mens, T., van Gorp, P.: A taxonomy of model transformation. Electron. Notes Theor. Comput. Sci. 152, 125–142 (2006)CrossRef
43.
Mishra, S., Weistroffer, H.: A framework for integrating Sarbanes-Oxley compliance into the systems development process. Commun. Assoc. Inf. Systems (CAIS) 20(1), 712–727 (2007)
44.
Nakamura Y., Tatsubori M., Imamura T., Ono K.: Model-driven security based on a web services security architecture. In: Proceedings of the IEEE International Conference on Services Computing, pp. 7–15. IEEE (2005)
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
Papazoglou, M., Traverso, P., Dustdar, S., Leymann, F.: Service-oriented computing: state of the art and research challenges. IEEE Comput. 40, 38–45 (2007)CrossRef
65.
Reznik, J., Ritter, T., Schreiner, R., Lang, U.: Model driven development of security aspects. Electron. Notes Theo. Comput. Sci. 163, 65–79 (2007)CrossRef
66.
Rodríguez, A., Fernández-Medina, E., Trujillo, J., Piattini, M.: Secure business process model specification through a UML 2.0 activity diagram profile. Decis. Support Syst. 51(3), 446–465 (2011)CrossRef
67.
Rodríguez, A., García-Rodríguez de Guzmán, I., Fernández-Medina, E., Piattini, M.: Semi-formal transformation of secure business processes into analysis class and use case models: an MDA approach. Inform. Softw. Technol. 52, 945–971 (2010)CrossRef
68.
Sánchez, Ó., Molina, F., García-Molina, J., Toval, A.: ModelSec: a generative architecture for model-driven security. J. Univ. Comput. Sci. 15(15), 2957–2980 (2009)
69.
Sandhu, R.: On five definitions of data integrity. In: Proceedings of the IFIP WG11.3 Working Conference on Database Security VII (1993)
70.
Scheer, A.-W.: ARIS: Business Process Modeling. Springer, Berlin (2000)
71.
Schefer, S., Strembeck, M.: Modeling process-related duties with extended UML activity and interaction diagrams. In: Proceedings of the International Workshop on Flexible Workflows in Distributed Systems, Electronic Communications of the EASST (2011)
72.
Schefer, S., Strembeck, M.: Modeling support for delegating roles, tasks, and duties in a process-related RBAC context. In: Proceedings of the International Workshop on Information Systems Security Engineering (WISSE), Lecture Notes in Business Information Processing (LNBIP), vol. 83. Springer, Berlin (2011)
73.
Schefer, S., Strembeck, M., Mendling, J.: Checking satisfiability aspects of binding constraints in a business process context. In: Proceedings of the Workshop on Workflow Security Audit and Certification (WfSAC), Lecture Notes in Business Information Processing (LNBIP), vol. 100. Springer, Berlin (2011)
74.
Schefer, S., Strembeck, M., Mendling, J., Baumgrass, A.: Detecting and resolving conflicts of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 19th International Conference on Cooperative Information Systems (CoopIS), Lecture Notes in Computer Science (LNCS), vol. 7044. Springer, Berlin (2011)
75.
Schefer-Wenzl, S., Strembeck, M.: An approach for consistent delegation in process-aware information systems. In: Proceedings of the 15th International Conference on Business Information Systems (BIS), Lecture Notes in Business Information Processing (LNBIP). Springer, Berlin (2012)
76.
Schefer-Wenzl, S., Strembeck, M.: Modeling context-aware RBAC models for business processes in ubiquitous computing environments. In: Proceedings of the 3rd International Conference on Mobile, Ubiquitous and Intelligent Computing (MUSIC) (2012)
77.
Schmidt, D.: Model-driven engineering: guest editor’s introduction. IEEE Comput. 39(2), 25–31 (2006)CrossRef
78.
Schmidt, H., Jürjens, J.: Connecting security requirements analysis and secure design using patterns and UMLsec. In: Proceedings of the 23rd International Conference on Advanced Information Systems Engineering (CAiSE), Lecture Notes in Computer Science (LNCS), pp. 367–382. Springer, Berlin (2011)
79.
Selic, B.: The pragmatics of model-driven development. IEEE Softw. 20(5), 19–25 (2003)CrossRef
80.
Sendall, S., Kozaczynski, W.: Model transformation: the heart and soul of model-driven software development. IEEE Softw. 20(5), 42–45 (2003)CrossRef
81.
Sobernig, S., Zdun, U.: Invocation assembly lines: patterns of invocation and message processing in object remoting middleware. In: Kelly, A., Weiss, M. (eds.) Proceedings of 14th Annual European Conference on Pattern Languages of Programming (EuroPLoP 2009), CEUR-WS.org, vol. 566. (2009)
82.
Stahl, T., Völter, M.: Model-Driven Software Development. Wiley, New York (2006)
83.
Steinberg, D., Budinsky, F., Paternostro, M., Merks, E.: EMF: Eclipse Modeling Framework. Addison-Wesley, Boston (2008)
84.
Strembeck, M., Mendling, J.: Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context. In: Proceedings of the 18th International Conference on Cooperative Information Systems (CoopIS), Lecture Notes in Computer Science (LNCS), vol. 6426. Springer, Berlin (2010)
85.
Strembeck, M., Mendling, J.: Modeling process-related RBAC models with extended UML activity models. Inform. Softw. Technol. 53(5), 456–483 (2011)CrossRef
86.
Tatsubori, M., Imamura, T., Nakamura, Y.: Best-practice patterns and tool support for configuring secure web services messaging. In: Proceedings of the IEEE International Conference on Web Services, pp. 244–251. IEEE (2004)
87.
Warner, J., Atluri, V.: Inter-instance authorization constraints for secure workflow management. In: Proceedings of the 11th ACM Symposium on Access Control Models and Technologies (SACMAT) (2006)
88.
89.
Wolter, C., Menzel, M., Meinel, C.: Modelling security goals in business processes. In Modellierung 2008, Lecture Notes in Informatics (LNI), pp. 197–212 (2008)
90.
Wolter, C., Menzel, M., Schaad, A., Miseldine, P., Meinel, C.: Model-driven business process security requirement specification. J. Systems Archit. 55(4), 211–223 (2009)CrossRef
91.
Wolter, C., Schaad, A.: Modeling of task-based authorization constraints in BPMN. In: Alonso, G., Dadam, P., Rosemann, M. (eds.) Proceedings of the 5th International Conference on Business Process Management (BPM), volume 4714 of Lecture Notes in Computer Science (LNCS), pp. 64–79. Springer, Berlin (2007)
92.
93.
94.
95.
Zdun, U.: Patterns of component and language integration. In: Manolescu, D., Völter, M., Noble, J. (eds.) Pattern Languages of Program Design 5 (2006)
96.
Zdun, U., Dustdar, S.: Model-driven and pattern-based integration of process-driven SOA models. Int. J. Business Process Integr. Manag. (IJBPIM) 2(2), 109–119 (2007)CrossRef
97.
Zdun, U., Hentrich, C., Dustdar, S.: Modeling process-driven and service-oriented architectures using patterns and pattern primitives. ACM Transact. Web 1(3), 14:1–14:44 (2007)
Metadaten
Titel
Modeling and enforcing secure object flows in process-driven SOAs: an integrated model-driven approach
verfasst von
Bernhard Hoisl
Stefan Sobernig
Mark Strembeck
Publikationsdatum
01.05.2014
Verlag
Springer Berlin Heidelberg
Erschienen in
Software and Systems Modeling / Ausgabe 2/2014
Print ISSN: 1619-1366
Elektronische ISSN: 1619-1374
DOI
https://doi.org/10.1007/s10270-012-0263-y

Weitere Artikel der Ausgabe 2/2014

Software and Systems Modeling 2/2014 Zur Ausgabe

Editorial

Introduction to the SoSyM theme issue on models and evolution

Regular Paper

Automatic data collection for enterprise architecture models

Theme Section Paper

Heuristics for composite Web service decentralization

Regular Paper

Automated resolution of connector architectures using constraint solving (ARCAS method)

Theme Section Paper

On the modeling and generation of service-oriented tool chains

Theme Section Paper

Adapting transformations to metamodel changes via external transformation composition