Abstract
Automatic translation of elicited consumer security requirements at high level (problem space) into application or service level security requirements (solution space) has been traditionally the Achilles’ heel of security requirements engineering. Such automated translation would result in significant failure and cost reduction in application development and maintenance, particularly in those complex applications based on compositions and choreographies of services. In this paper we present a framework which makes a step forward to solve this dilemma. The framework supports the engineering of composite service security and trust requirements directly derived from the organisational needs expressed for such service. The followed approach starts with the modelling of organisation actors’ objectives and commitments among these actors, and follows with the transformation of such commitments into security elements in the service business process specification and into a consumer security policy which the service will need to be compliant with.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Aktug, I., Naliuka, K.: ConSpec — a formal language for policy specification. Electronic Notes in Theoretical Computer Science 197(1), 45–58 (2008)
Aniketos Website, http://www.aniketos.eu
Baxter, G., Sommerville, I.: Socio-technical systems: From design methods to systems engineering. Interacting with Computers 23(1), 4–17 (2011)
Bresciani, P., Perini, A., Giorgini, P., Giunchiglia, F., Mylopoulos, J.: Tropos: An agent-oriented software development methodology. Autonomous Agents and Multi-Agent Systems 8(3), 203–236 (2004)
Brucker, A.D., Hang, I., Lückemeyer, G., Ruparel, R.: SecureBPMN: Modeling and enforcing access control requirements in business processes. In: Proceedings of the 17th ACM symposium on Access Control Models and Technologies, pp. 123–126. ACM (June 2012)
Brucker, A.D., Malmignati, F., Merabti, M., Shi, Q., Zhou, B.: A Framework for Secure Service Composition. In: International Conference on Information Privacy, Security, Risk and Trust (PASSAT), pp. 1–6. IEEE (September 2013)
Dalpiaz, F., Paja, E., Giorgini, P.: Security requirements engineering via commitments. In: 2011 1st Workshop on Socio-Technical Aspects in Security and Trust (STAST), pp. 1–8 (September 2011)
Dragoni, N., Massacci, F., Naliuka, K., Siahaan, I.: Security-by-contract: Toward a semantics for digital signatures on mobile code. In: López, J., Samarati, P., Ferrer, J.L. (eds.) EuroPKI 2007. LNCS, vol. 4582, pp. 297–312. Springer, Heidelberg (2007)
Emery, F.E., Trist, E.L.: Socio-Technical Systems. Management Science, Models and Techniques 2, 83–97 (1960)
ENISA. Procure Secure: A guide to monitoring of security service levels in cloud contracts (April 2012), http://www.enisa.europa.eu/activities/Resilience-and-CIIP/cloud-computing/procure-secure-a-guide-to-monitoring-of-security-service-levels-in-cloud-contracts (Cited on September 10, 2013)
Erlingsson, U.: The inlined reference monitor approach to security policy enforcement. Cornell University (2003)
Giorgini, P., Massacci, F., Mylopoulos, J., Zannone, N.: Modeling security requirements through ownership, permission and delegation. In: Proceedings of the 13th IEEE International Conference on Requirements Engineering, pp. 167–176. IEEE (August 2005)
Trist, E.L.: On socio-technical systems. Sociotechnical systems: A sourcebook, 43-57 (1978)
Menzel, M., Thomas, I., Meinel, C.: Security requirements specification in service-oriented business process management. In: International Conference on Availability, Reliability and Security, ARES 2009, pp. 41–48. IEEE (March 2009)
Mouratidis, H., Giorgini, P.: Secure tropos: A security-oriented extension of the tropos methodology. International Journal of Software Engineering and Knowledge Engineering 17(02), 285–309 (2007)
Mulle, J., Stackelberg, S., Bohm, K.: A Security Language for BPMN Process Models. Karlsruhe Reports in Informatics (September 2011)
Noguero, A., Espinoza, H.: A generic executable framework for model-driven engineering. In: 2012 7th Iberian Conference on Information Systems and Technologies (CISTI), pp. 1–6. IEEE (June 2012)
OASIS, Reference Model for Service Oriented Architecture 1.0 (2009), http://docs.oasis-open.org/soa-rm/soa-ra/v1.0/soa-ra.pdf (cited September 12, 2013)
OMG. Business Process Model and Notation (BPMN) Version 2.0 (2011), http://www.omg.org/spec/BPMN/2.0/ (Cited on September 10, 2013)
Paja, E., Dalpiaz, F., Giorgini, P.: Identifying Conflicts in Security Requirements with STS-ml. University of Trento. Technical report (2012)
Paja, E., Dalpiaz, F., Poggianella, M., Roberti, P., Giorgini, P.: STS-Tool: Specifying and Reasoning over Socio-Technical Security Requirements. In: iStar 2013, pp. 131–133 (2013)
Rodríguez, A., Fernández-Medina, E., Piattini, M.: A bpmn extension for the modeling of security requirements in business processes. IEICE Transactions on Information and Systems 90(4), 745–752 (2007)
Salnitri, M., Dalpiaz, F., Giorgini, P.: Aligning Service-Oriented Architectures with Security Requirements. In: Meersman, R., Panetto, H., Dillon, T., Rinderle-Ma, S., Dadam, P., Zhou, X., Pearson, S., Ferscha, A., Bergamaschi, S., Cruz, I.F. (eds.) OTM 2012, Part I. LNCS, vol. 7565, pp. 232–249. Springer, Heidelberg (2012)
Singh, M.P.: An ontology for commitments in multiagent systems. Artificial Intelligence and Law 7(1), 97–113 (1999)
University of trento, STS-ml manual (2013), http://www.sts-tool.eu/doc/STS-ModelingLanguage_ver1.3.2.pdf (cited September 12, 2013)
Wolter, C., Menzel, M., Meinel, C.: Modelling Security Goals in Business Processes. Modellierung 127, 201–216 (2008)
van Lamsweerde, A.: Requirements engineering in the year 00: a research perspective. In: Proceedings of the 22nd International Conference on Software Engineering, pp. 5–19 (2000)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer International Publishing Switzerland
About this chapter
Cite this chapter
Rios, E., Malmignati, F., Iturbe, E., D’Errico, M., Salnitri, M. (2014). From Consumer Requirements to Policies in Secure Services. In: Brucker, A.D., Dalpiaz, F., Giorgini, P., Meland, P.H., Rios, E. (eds) Secure and Trustworthy Service Composition. Lecture Notes in Computer Science, vol 8900. Springer, Cham. https://doi.org/10.1007/978-3-319-13518-2_6
Download citation
DOI: https://doi.org/10.1007/978-3-319-13518-2_6
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-13517-5
Online ISBN: 978-3-319-13518-2
eBook Packages: Computer ScienceComputer Science (R0)