eprintid: 3010
rev_number: 2
eprint_status: archive
userid: 1
dir: disk0/00/00/30/10
datestamp: 2023-11-09 15:51:16
lastmod: 2023-11-09 15:51:16
status_changed: 2023-11-09 15:44:47
type: article
metadata_visibility: show
creators_name: Saleem, M.Q.
creators_name: Jaafar, J.B.
creators_name: Hassan, M.F.
title: Model-based security engineering of SOA systems using modified "UML-SOA-Sec"
ispublished: pub
keywords: Applications development; Business Process; Business process model; Business process modelling; Cross-domain; Design phase; Development phasis; Domain specific languages; General purpose; Health-care system; Low-level integration; Model driven development; Model driven security; Modelling language; Proof of work; Security engineering; Security experts; Security implementations; Security objectives; Security requirements; Software development approach; Software systems, Health care; Information services; Mathematical models; Service oriented architecture (SOA); Software design, Unified Modeling Language
note: cited By 5
abstract: In SOA environment, software systems are composed of services which are scattered across enterprises and architectures. Security play vital role during the design, development and operation of SOA application. However, analysis of today's software development approaches reveals that the engineering of security into the system design is often neglected. Currently security is incorporated in SOA applications in an ad-hoc manner and integrated during the applications development phase or administration phase or it is out sourced. In practice security is not defined during the early phases of software development and left onto developers. Properly configuring security requirements in SOA applications is quite difficult for developers because they are not security experts; furthermore, SOA security is cross-domain and all required information is not available at downstream phases. This reveals the importance of adding security objectives in early development phases i.e. at design phase by the business process expert. However, a business process expert is unable to specify security objectives due to lake of security modelling elements in a general purpose modelling languages. As a result, he/she either ignores the security objectives in a business process model or indicates them in textual way. The post-hoc, low-level integration of security has a negative impact on resulting SOA applications. A Domain Specific Language named "UML-SOA-Sec" is proposed for the Model driven development of secure SOA systems based on the UML. Aim is to facilitate the business process expert in modelling the security requirements along the business process modelling. This security annotated business process model will facilitate the security expert in specifying the concrete security implementation. As a proof of work; proposed "UML-SOA-Sec" is applied to modelling of a typical business process of healthcare system.
date: 2012
official_url: https://www.scopus.com/inward/record.uri?eid=2-s2.0-84861840518&doi=10.4156%2fAISS.vol4.issue9.10&partnerID=40&md5=957e576795f1ac431e09b3d458b7c162
id_number: 10.4156/AISS.vol4.issue9.10
full_text_status: none
publication: Advances in Information Sciences and Service Sciences
volume: 4
number: 9
pagerange: 79-88
refereed: TRUE
issn: 19763700
citation:   Saleem, M.Q. and Jaafar, J.B. and Hassan, M.F.  (2012) Model-based security engineering of SOA systems using modified "UML-SOA-Sec".  Advances in Information Sciences and Service Sciences, 4 (9).  pp. 79-88.  ISSN 19763700