Automatic Transformation of Generic , Validated Business Process Security Models to WS - SecurityPolicy Descriptions

An increasing need for security in SOA applications demands for better support for the management of security in Web-based business processes. Here, the model-driven process development may provide valuable opportunities in terms of maintainability and deployment. Besides modeling and then generating the pure functionality of a process, the consideration of security properties at the level of a process model allows us to derive appropriate Web Service security policies as well. Especially important when dealing with security issues is the need of trust in the deployed processes and the development process as well. In this chapter, the authors discuss the general capabilities and constraints for model-driven security. Furthermore, the authors focus on the automatic transformation of security models into executable security implementations as well as on the validation of the security models to ensure their correctness. Based on the discussion, the authors present a transformation mechanism that automatically derives WS-SecurityPolicy-conformant security policies. Moreover, the chapter presents a validation mechanism for the security model which is based on graphical validation rules. The application of both mechanisms allows the automatic deployment of validated, security-enabled Web Service based business processes.