Composite Application Using Security Annotations
Automatic secure application composition, in which a specification for a business process is accessed, the specification including a security annotation that defines a security intention, and a task that defines at least a portion of the business process, and that calls an external service. A security pattern associated with the security annotation is invoked, and a service provider associated with the external service that satisfies the security intention is identified based on the invoked security pattern. The business process is invoked using the identified service provider.
1 . A computer-implemented method comprising:
accessing a specification for a business process, the specification including:
a security annotation that defines a security intention, and
a task that defines at least a portion of the business process, and that calls an external service;
invoking a security pattern associated with the security annotation;
identifying a service provider associated with the external service that satisfies the security intention, based on the invoked security pattern; and
invoking the business process using the identified service provider.
2 . The method of claim 1 , wherein the security annotation is expressed using a policy domain-specific language.
3 . The method of claim 1 , further comprising parsing the security annotation.
4 . The method of claim 1 , further comprising updating a security policy database based on the security annotation.
5 . The method of claim 1 , wherein identifying a service provider further comprises:
accessing service access information for a list of service providers, the service access information including a service end point and service operation signatures;
accessing a stored security objective and a stored security capability for each of the service providers in the list of service providers;
comparing the stored security objectives and the stored security capability for each of the service providers to a security objective and a security capability associated with the security intention;
selecting a selected service provider based on comparing the stored security objective and the stored security capability for each of the service providers;
storing the selected service provider in a knowledge base as the identified service provider; and
generating an event indicating that a service provider selection process has been completed based on storing the selected service provider.
6 . The method of claim 1 , wherein invoking the business process using the identified service provider further comprises:
generating a secure service proxy for the identified service provider based on the security intention, the secure service proxy managing a secure service calls operation to the external service; and
calling the external service using the secure service proxy.
7 . The method of claim 6 , further comprising:
encrypting the secure service proxy; and
storing the encrypted secure service proxy.
8 . The method of claim 7 , further comprising:
retrieving the stored secure service proxy;
invoking the secure service call operation associated with the secure service proxy;
receiving a response from the external service; and
processing the response using the secure service proxy.
9 . The method of claim 1 , wherein the service is a back-end enterprise service, an external business-to-business service, or a local service.
10 . The method of claim 1 , wherein the security annotation includes a variable representing the security intention, and wherein the security pattern is invoked using the variable.
11 . The method of claim 1 , wherein the security intention declares an external enforcement policy when using an external web service, declares policies when exposing the invoked business process as a web service, declares a tasked-based authorization requirement when the task requires a human interaction, and declares task-based authorization constraints which specify an order in which the task is executed.
12 . The method of claim 1 , wherein the security intention specifies roles that are allowed to execute the task.
13 . The method of claim 1 , wherein the security intention specifies an order in which the task is executed.
14 . The method of claim 1 , wherein invoking the business process further comprises executing the task.
15 . The method of claim 14 , wherein the security pattern comprises:
a first entry point used to trigger enforcement of the security intention before the service provider is identified,
a second entry point used to trigger enforcement of the security intention before the task is executed, and
a third entry point used to trigger enforcement of the security intention after the task is executed.
16 . The method of claim 15 , wherein invoking the business process further comprises:
selecting the first entry point if the service provider has not yet been identified;
selecting the second entry point if the task has not yet been executed; and
selecting the third entry point if the task has been executed.
17 . The method of claim 1 , wherein identifying the service provider further comprises:
generating a service request; and
security enhancing the service request based on the security pattern.
18 . The method of claim 1 , wherein the security intention defines a message confidentiality, encryption security intention, integrity intention, role assignment intention, or task execution order intention.
19 . A computer program product, tangibly embodied in a machine-readable medium, the computer program product comprising instructions that, when read by a machine, operate to cause a data processing apparatus to:
access a specification for a business process, the specification including:
a security annotation that defines a security intention, and
a task that defines at least a portion of the business process, and that calls an external service;
invoke a security pattern associated with the security annotation;
identify a service provider associated with the external service that satisfies the security intention, based on the invoked security pattern; and
invoke the business process using the identified service provider.
20 . A device comprising:
a storage medium storing a specification for a business process, the specification including:
a security annotation that defines a security intention, and
a task that defines at least a portion of the business process, and that calls an external service; and
a processor configured to:
invoke a security pattern associated with the security annotation,
identify a service provider associated with the external service that satisfies the security intention, based on the invoked security pattern, and
invoke the business process using the identified service provider.