Security Engineering for Service-Oriented Architectures

"While their basic principles and ideas are well understood and cogent from a conceptual perspective, the realization of interorganizational workflows and applications based on service-oriented architectures (SOAs) remains a complex task, and, especially when it comes to security, the implementation is still bound to low-level technical knowledge and hence inherently error-prone. Hafner and Breu set a different focus. Based on the paradigm of model-driven security, they show how to systematically design and realize security-critical applications for SOAs. In their presentation, they first detail how systems and security engineering go hand in hand and are integrated from the very start in the requirements elicitation and the design phase. In a second step, they apply the principles of model-driven security to SOAs. Model-driven security is an engineering paradigm that aims at the automatic generation of security-critical executable software for target architectures. Based on the general principles of model-driven software development, the automation of security engineering through proven and reliable mechanisms guarantees correctness and facilitates an agile and flexible approach to the implementation and high-level management of security-critical systems. Their book addresses IT professionals interested in the design and realization of modern security-critical applications. It presents a synthesis of various best practices, standards and technologies from model-driven software development, security engineering, and SOAs. As a reader, you will learn how to design and realize SOA security using the framework of an extensible domain architecture for model-driven security."--Publisher's description The growing popularity of Service Oriented Architectures is mainly due to business and technology trendsthat have crystallized over thepast decade. On the business side, companies struggle to survive in a competitive - vironment that pushes them towards a tighter integration into an industry's value chain, to outsource non core business operations or to constantly- engineer business processes. These challenges boosted the demand for sc- able IT-solutions, with e?orts ultimately resulting in a ?exible architectural paradigm - Service Oriented Architectures. On the technical side, middleware standards, technologies and archit- turesbasedonXMLand Webservicesaswellastheirsecurityextensionshave matured to a sound technology base that guarantees interoperability across enterprise and application boundaries - a prerequisite to inter-organizational applications and work?ows. While the principles and concepts of Service Oriented Architectures may lookevidentandcogentfromaconceptualperspective, therealizationofint- organizational work?ows and applications based on the paradigm "Service Oriented Architecture" remains a complex task, and, all the more when it comes to security, the implementation is still bound to low-level technical knowledgeandhence error-prone. The number of books and publications o?ering implementation-level c- erageofthetechnologies, standardsandspeci?cationsasrequiredbytechnical developers lookingfor guidance on how to"add"security to service oriented solutions based on Web services and XML technology is already considerable and ever growing. The present book sets a di?erent focus. Based on the p- adigmof Model Driven Security, it shows how to systematically designand realize security-critical applications for Service Oriented Architectures. Front Matter....Pages I-XVI Front Matter....Pages 1-1 Introduction....Pages 3-13 SOA — Standards & Technology....Pages 15-25 Basic Concepts of SOA Security....Pages 27-45 Domain Architectures....Pages 47-59 Front Matter....Pages 61-63 Sectino — A Motivating Case Study from E-Government....Pages 65-70 Security Analysis....Pages 71-91 Modeling Security Critical SOA Applications....Pages 93-119 Enforcing Security with the Sectet Reference Architecture....Pages 121-140 Model Transformation & Code Generation....Pages 141-151 Software & Security Management....Pages 153-158 Extending Sectet: Advanced Security Policy Modeling....Pages 159-186 Front Matter....Pages 187-187 health@net — A Case Study from Healthcare....Pages 189-222 Back Matter....Pages 223-245 Based on the paradigm of model-driven security, the authors of this book show how to systematically design and realize security-critical applications for SOAs. In a second step, they apply the principles of model-driven security to SOAs.