Security Requirements Specification in Process-aware Information Systems

Abstract

Service-oriented Architectures deliver a flexible infrastructure to allow independently developed software com-ponents to communicate in a seamless manner. In the scope of organisational workflows, SOA provides a suitable foundation to execute business processes as an orchestration of multiple independent services. In order to secure services, requirements are usually defined on a technical level, rather than on an organisational level that would provide a comprehensive view on the participants, the assets and their relationships regarding security.

In this paper, we present a compilation of security requirements for Service-oriented Architectures and propose an approach to express these security requirements at the business process layer. An enhancement for BPMN is introduced to model these security requirements and illustrated in an example process that is deployed on a cross-organisational SOA infrastructure. Our aim is to facilitate the generation of security configurations on a technical level based on the modelled requirements. For this purpose, we foster a model-driven approach that is described as a suitable approach for future development.