Security Engineering for Service-Oriented Architectures

Transcription

1 Security Engineering for Service-Oriented Architectures Bearbeitet von Michael Hafner, Ruth Breu 1. Auflage Buch. xvi, 248 S. Hardcover ISBN Format (B x L): 15,5 x 23,5 cm Gewicht: 561 g Weitere Fachgebiete > EDV, Informatik > Datenbanken, Informationssicherheit, Geschäftssoftware > Zeichen- und Zahlendarstellungen Zu Leseprobe schnell und portofrei erhältlich bei Die Online-Fachbuchhandlung beck-shop.de ist spezialisiert auf Fachbücher, insbesondere Recht, Steuern und Wirtschaft. Im Sortiment finden Sie alle Medien (Bücher, Zeitschriften, CDs, ebooks, etc.) aller Verlage. Ergänzt wird das Programm durch Services wie Neuerscheinungsdienst oder Zusammenstellungen von Büchern zu Sonderpreisen. Der Shop führt mehr als 8 Millionen Produkte.

2 Contents Part I The Basics of SOA Security Engineering 1 Introduction ServiceOrientedArchitecture Interoperability and Securitiy Issues in SOA Model Driven Security Engineering Problem Description Contribution ProSecO Sectet Related Work Model Driven Security Formal Systems Engineering Pattern-based Approaches Tools and Frameworks Workflow Management SOA - Standards & Technology ServiceOrientedArchitectures Principles of SOA Motivating Example WebServices Basic Definition Service Invocation Service Description and Discovery The Web Services Specification Stack Transport Layer Messaging Layer Description Layer Discovery Layer Quality of Service Layer

3 XII Contents Web Services Security Standards Services Composition Layer Basic Concepts of SOA Security What Is (SOA) Security? Security Objectives Security Policies Basic Security Policies Policy Models Advanced Security Policies Security Analysis Security Requirements Attacks Web Services Security Standards Confidentiality, Integrity, and Authenticity Authentication Advanced Web Services Security Standards Domain Architectures ModelDrivenSoftwareDevelopment The Unified Modeling Language The Meta-Object Facility Model Driven Software Development Model Driven Architecture Model Driven Security A Definition of Model Driven Software Development Domain Specific Languages TheTargetArchitecture Model-(to-model-)to-code Transformation Domain Architecture Framework Model Driven Security Definition Extensions to the Problem Space Part II Realizing SOA Security 5 Sectino A Motivating Case Study from E-Government ProblemContext ProjectMission Expected Benefits Scenario Description Requirements Security Requirements Results... 70

4 Contents XIII 6 Security Analysis Overview Modularity Traceability Model-driven Configuration of Security Services Tight Integration of Functional and Security Aspects Security as a Process Functional System View Level of Interaction Level of Abstraction Functional Meta-models Global Functional Meta-model Local Functional Meta-model Security Analysis Process Security Concepts The Security Micro-process Elaborate Functional Model Define Security Objectives Identify Dependencies Security Requirements Engineering Threat and Risk Analysis Security Control Engineering Access Control Related Work Standards and Baseline Protection Security Management Security Analysis in the Software Process Formal Approaches to Security Requirements Specification Modeling Security Critical SOA Applications The Sectet Domain Specific Language Domain Definition Global Worklfow Local Worklfow Sectet ModelViews Security Policies TheDSLMeta-models The Workflow View The Interface View Integrating Security into the DSL

5 XIV Contents 8 Enforcing Security with the Sectet Reference Architecture Architectural Blueprint Components Service Components Security Components Supporting Security Components Communication Protocols Enforcing Confidentiality and Integrity Enforcing Non-repudiation Component Configuration Inbound Messaging - (Executable Security Policy File) Outbound Messaging - (Executable Security Policy Files) Request for Compliance Check Response Request for Compliance Check Technology and Standards Model Transformation & Code Generation Transformations in the Sectet-Framework The Generation of Security Artefacts The Generation of Services Artefacts Security Transformations Inbound Policy File Outbound Policy Files Services Transformations Global Workflow to Local Workflow Translation Global Workflow to WSDL Description Global Workflow to XSD Schema Template Implementing Transformation Template Based Transformations Meta-model Based Transformations Software & Security Management Tool Chain Modeling Code Generation Build Tools and Integrated Development Environments The Realization Process The Engineering Process The Deployment Process Extending Sectet: Advanced Security Policy Modeling Motivation Extending the DSL A New Security Objective

6 Contents XV Advanced Security Policies Introducing the RBAC Policy Model Modeling Policies with Dynamic Constraints Sectet-PL Static RBAC Dynamic RBAC Rights Delegation Integrating Sectet-PL into the Sectet-Framework Metamodel Extensions Sectet-PL -Abstract Syntax Extending the Reference Architecture Access Control, Delegation and Privacy Policies Protocol Extensions PDP Extensions Sectet-PL Transformations Modeling Advanced Use Cases with Sectet-PL Break-Glass Policy (BGP) Eyes-Principle Usage Control (UC) Qualified Signature Part III A Case Study from Healthcare 12 health@net A Case Study from Healthcare Background The Electronic Healthcare Record National E-Health Initiatives Technical Standards for Healthcare The Austrian Data Privacy Law health@net Project Mission Organizational Setting Architectural Concept health@net Security Analysis Introduction Functional System View Identification of Security Objectives Engineering of Security Requirements Conclusion health@net Security Concept Phase 1: Service-level Security Phase 2a: Static, Process-level Security Phase 2b: Dynamic, Process-level Security Realizing Security with the Sectet-Framework...207

7 XVI Contents Conceptual Background Model Views Phases 2a & 2b Use Cases Security Architecture Part IV Appendices A Mapping Tables A.1 Mapping Table for Inbound Policy File A.2 Mapping Table for Outbound Policy Files A.3 MappingTableforBPELFiles A.4 Mapping Table for BPEL Files (continued) A.5 MappingTableforWSDLFiles References Index...243