Towards a BPEL model-driven approach for Web services security
Towards a BPEL model-driven approach for Web services security
复制标题
DOI：
10.1109/pst.2012.6297928
复制
发表时间：
2012-07
期刊：
影响因子：
--
通讯作者：
Hanine Tout;A. Mourad;H. Yahyaoui;C. Talhi;Hadi Otrok
中科院分区：
文献类型：
--
作者：
Hanine Tout;A. Mourad;H. Yahyaoui;C. Talhi;Hadi Otrok
通过处理Web服务的编排、组合和交互，业务流程执行语言（BusinessProcessExecutionLanguage，简称BPEL）引起了人们极大的兴趣。然而，这种基于流程的语言并不能保证Web服务组合的安全环境。密钥解决方案不能被看作是在业务逻辑的源代码中简单地嵌入安全属性，因为当安全措施更新时，将影响安全过程的动态性。在这种情况下，已经出现了几种方法来解决这样的问题，通过提供独立于基于策略语言的业务逻辑来指定安全属性的能力。然而，这些语言复杂，冗长，需要编程专业知识。由于这些困难，指定和实施的安全策略成为非常繁琐的任务。为了减轻这些挑战，我们在本文中提出了一种新的方法，利用统一建模语言（UML）和面向方面的范式（AOP）。通过阐述一个UML扩展机制，称为UML配置文件，我们的方法为用户提供了基于模型的功能，指定方面，强制执行所需的安全策略。另一方面，当通过利用AOP方法在部署过程中实施安全加固解决方案时，它提供了高度的灵活性。我们说明了我们的方法，通过一个例子的动态生成和集成的基于模型的安全方面在一个可扩展的过程。
By handling the orchestration, composition and interaction of Web services, the Business Process Execution Language (BPEL) has gained tremendous interest. However, such process-based language does not assure a secure environment for Web services composition. The key solution cannot be seen as a simple embed of security properties in the source code of the business logic since the dynamism of the BPEL process will be affected when the security measures get updated. In this context, several approaches have emerged to tackle such issue by offering the ability to specify the security properties independently from the business logic based on policy languages. Nevertheless, these languages are complex, verbose and require programming expertise. Owing to these difficulties, specifying and the enforcing BPEL security policies become very tedious tasks. To mitigate these challenges, we propose in this paper, a novel approach that takes advantage of both the Unified Modeling Language (UML) and the Aspect Oriented Paradigm (AOP). By elaborating a UML extension mechanism, called UML Profile, our approach provides the users with model-based capabilities to specify aspects that enforce the required security policies. On the other hand, it offers a high level of flexibility when enforcing security hardening solutions in the BPEL process by exploiting the AOP approach. We illustrate our approach through an example of the dynamic generation and integration of model-based security aspects in a BPEL process.