Specification and querying of security constraints in the EFSOC framework

Abstract

Service-Oriented Computing is a new paradigm for the specification and deployment of distributed services in highly dynamic environments. The very nature of the context in which service oriented computing thrives imposes unique security requirements. Large scale interconnection of systems and services, rapidly changing service compositions and adhoc composition and invocation of services require a flexible security model that is able to adapt to these changes. In this paper, we present an approach to specification and querying of security (access control) constraints in the context of the event-driven framework for service-oriented computing. 1

The practical application of a process for eliciting and designing security in web service systems

“…This work describes an adaptation of Tropos which permits the definition of an architecture that covers a certain set of WS-based Quality-of-Service requirements. EFSOC [9] is an event-driven framework for WSbased systems which specifies a security model that can be easily adopted by systems in which the degree of modifiability is very high, thereby requiring the continuous review and updating of authorization policies. In [10], a formal analysis of security-critical service-based software systems is presented and in [11] a formal approach to the construction of service-based systems is described.…”