Despite an increasing need for considering security requirements in service composition, the incorporation of security requirements into service composition is still a challenge for many reasons: no clear identification of security requirements for composition, absence of notations to express them, difficulty in integrating them into the business processes, complexity of mapping them into security mechanisms, and the complexity inherent to specify and enforce complex security requirements. We identify security requirements for service composition and define notations to express them at different levels of abstraction. We present a novel approach consisting of a methodology, called Sec-MoSC, to incorporate security requirements into service composition, map security requirements into enforceable mechanisms, and support execution. We have implemented this approach in a prototype tool by extending BPMN notation and building on an existing BPMN editor, BPEL engine and Apache Rampart. We showcase an illustrative application of the Sec-MoSC toolset.

/pdf/incorporating-security-requirements-into-service-composition-15wsmimsdo.pdf

Incorporating Security Requirements into Service Composition: From Modelling to Execution

process of aggregating services with disparate functionalities into a new composite service in order to meet increasingly complex needs of users. Service composition process has been accurate on dealing with services having disparate functionalities, however, over the years the number of web services in particular that exhibit similar functionalities and varying Quality of Service (QoS) has significantly increased. As such, the problem becomes how to select appropriate web services such that the QoS of the resulting composite service is maximized or, in some cases, minimized. This constitutes an NP-hard problem as it is complicated and difficult to solve. In this paper, a discussion of concepts of web service composition and a holistic review of current service composition techniques proposed in literature is presented. Our review spans several publications in the field that can serve as a road map for future research.

/pdf/a-survey-of-qos-aware-web-service-composition-techniques-16qam8x6qa.pdf

A Survey of QoS-aware Web Service Composition Techniques

In this paper we show how the application of the aspect-oriented programming paradigm to runtime adaptation of service compositions can be used to prevent SLA violations. Adaptations are triggered by predicted violations, and are implemented as substitutions of fragments in the service composition. Fragments are full-fledged standalone compositions, and are linked into the original composition via special activities, which we refer to as virtual activities. Before substitution we evaluate fragments with respect to their expected impact on the performance of the composition, and choose those fragments which are best suited to prevent a predicted violation. We show how our approach can be implemented using Windows Workflow Foundation technology, and discuss our work based on an illustrative case study.

/pdf/preventing-sla-violations-in-service-compositions-using-3yq2wn6kqp.pdf

Preventing SLA Violations in Service Compositions Using Aspect-Based Fragment Substitution

Typically, in areas such as e-business and e-government, among others, Web services are used as basic components for building business processes. Participants in a business process may have different computational platforms that should interoperate in order to achieve the process goals. This interoperability is supported by the Web service technology. Thus, the importance of the technology is growing and its use in these areas demands security concern. However, the current approach for building processes from services, based on the Web Services Business Process Execution Language (WS-BPEL), does not consider security. This paper proposes an approach for building processes according to provider capabilities and consumer security requirements. These characteristics are expressed using Web Services Policy Framework (WS-Policy) policies and a Web Ontology Language (OWL) ontology. The main contribution of this paper is the use of semantics-enriched security policies for enriching Web service business processes.

Ontology-Based Security Policies for Supporting the Management of Web Service Business Processes

Distributed systems are commonly required to be flexible and scalable, as the number and arrangement of their (potentially mobile) devices may easily change. Security in distributed systems is a complex issue which can produce several problems such as eavesdropping, phishing or denial of service. To overcome these problems, there are various security measures that can be applied. This study proposes the use of dynamic aspect-oriented software development (AOSD) to implement security mechanisms in distributed systems. By applying dynamic separation of concerns using AOSD, it becomes possible to adapt the security measures of distributed systems, even when their sizes and arrangements change, without compromising global security. These changes can be applied when a distributed system is running, without requiring its execution to be stopped or interrupted. Using the dynamic and static aspect weaving AOSD platform, the authors have implemented solutions for two common security problems in distributed systems: (i) access control and data flow and (ii) encryption of transmissions. Moreover, the proposed approach has been tested in a real client-server FTP scenario. Qualitative and quantitative evaluations of both implementations are presented to estimate the pros and cons of using dynamic AOSD in the development of security measures of distributed systems.

Applying dynamic separation of aspects to distributed systems security: A case study

Web service composition is to construct complex service through combining available services components as request. Service composition often has to handle the security risk that can not be predicted when the service components are developed. This paper presents an aspect-oriented (AO) approach to enhance the security of service composition that can not only realize flexible security policies but also accomplish it with very little run-time overhead. The security control is separated from other functional requirements and encapsuled into service extension aspect. And the composition can be extended by weaving the extension at runtime. It also gives the service composer a chance to unify security policy in composed service by specifying appropriate security extension himself. A Web service extension environment (WSXE) is devised to demonstrate the approach. Finally, an application of performing user-defined access control dynamically at runtime is given to exemplify the dynamic extension to service composition

Dynamic Weaving of Security Aspects in Service Composition

Web Service composition is to construct complex service through combining available services components as request. A service component is a self-contained unit of service construction that provides an identifiable and distinct part of a service with well-defined interface. For example, to assure the security of web service, both the service provider and requestor should take account of the security control. But the implementation of crosscutting concerns, such as security control, will scatter in multiple components. In this paper we adopt the Aspect-Oriented Programming (AOP) to separate security control from other functional requirements. AOP is a new software development paradigm that aims to increase comprehensibility, adaptability, and reusability by introducing aspect to modularize the crosscutting concerns. Any behavior associated to several components is encapsulated into an aspect. In our work, the composition is extended by weaving extension at running time. It makes the service composition more flexible and gives the composer a chance to unify security policy in composed service by specifying appropriate security extension himself. This paper also presents an infrastructure to demonstrate how dynamic weaving of aspects can be used to enhance the security of service composition. An application of performing user-defined access control dynamically at run-time is given to exemplify the dynamic extension to service composition.

Yingyu Yin

Papers

Dynamic Weaving of Security Aspects in Service Composition

Dynamic Aspects Weaving in Service Composition