A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Various types of security goals, such as authentication or confidentiality, can be defined as policies for service-oriented architectures, typically in a manual fashion. Therefore, we foster a model-driven transformation approach from modelled security goals in the context of process models to concrete security implementations. We argue that specific types of security goals may be expressed in a graphical fashion at the business process modelling level which in turn can be transformed into corresponding access control and security policies. In this paper we present security policy and policy constraint models. We further discuss a translation of security annotated business processes into platform specific target languages, such as XACML or AXIS2 security configurations. To demonstrate the suitability of this approach an example transformation is presented based on an annotated process. <s> BIB001 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Cloud computing enables the provisioning of dynamically scalable resources as a service. Next to cloud computing, the paradigm of Service-oriented Architectures emerged to facilitate the provisioning of functionality as services. While both concepts are complementary, their combination enables the flexible provisioning and consumption of independently scalable services. These approaches come along with new security risks that require the usage of identity and access management solutions and information protection. The requirements concerning security mechanisms, protocols and options are stated in security policies that configure the interaction between services and clients in a system. In this paper, we present our cloud-based Service Security Lab that supports the on-demand creation and orchestration of composed applications and services. Our cloud platform enables the testing, monitoring and analysis of Web Services regarding different security configurations, concepts and infrastructure components. Since security policies are hard to understand and even harder to codify, we foster a model-driven approach to simplify the creation of security configurations. Our model-driven approach enables the definition of security requirements at the modelling layer and facilitates a transformation based on security configuration patterns. <s> BIB002 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> The support for non-functional concerns (NFC) is essential for the success and adoption of web services. However, state of the art works offer only a limited support for these concerns especially when it comes to the composition of multiple non-functional concerns with composite web services. In this paper, we focus on the composition of non-functional actions (NFA) with composite web services whose composition logic is made explicit using languages such as BPMN2 or WS-BPEL (gray box view). In contrast to the black box view where only the interface of the service is visible the gray box view reveals additional information on control flow, data flow, composed services, etc. NFAs can also be composite and constitute complex processes such as secure conversations or transactions which have to be integrated with composite web services. Additionally, the execution order of multiple superimposing NFA has to be declared. In our approach we introduce a model-driven approach for the integrated specification and realization of the different types of NFC composition (NFAs with composite services, execution order of superimposing NFAs and composite NFAs) as well as a set of editors and code generators supporting this approach. <s> BIB003 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Modern information systems are large-sized and comprise multiple heterogeneous and autonomous components. Autonomy enables decentralization, but it also implies that components providers are free to change, retire, or introduce new components. This is a threat to security, and calls for a continuous verification process to ensure compliance with security policies. Existing verification frameworks either have limited expressiveness—thereby inhibiting the specification of real-world requirements—, or rely on formal languages that are hardly employable for modeling and verifying large systems. In this paper, we overcome the limitations of existing approaches by proposing a framework that enables: (1) specifying information systems in SecBPMN, a security-oriented extension of BPMN; (2) expressing security policies through SecBPMN-Q, a query language for representing security policies; and (3) verifying SecBPMN-Q against SecBPMN specifications via an implemented query engine. We report on the applicability of our approach via a case study about air traffic management. <s> BIB004 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Making today’s systems secure is an extremely difficult and challenging problem. Socio and technical issues interplay and contribute in creating vulnerabilities that cannot be easily prevented without a comprehensive engineering method. This paper presents a novel approach to support process-aware secure systems modeling and automated generation of secure artifact-centric implementations. It combines social and technical perspectives in developing secure systems. This work is the result of an academic and industrial collaboration, where SecBPMN2, a research prototype, has been integrated with SAP River, an industrial artifact-centric language. <s> BIB005 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> The use of business process standards to model and execute business needs is growing rapidly. In addition, Service-oriented Computing has been adopted to realize business processes, which basically consists of executing the process activities using services available in the Internet. In this context, the importance of security is apparent, because sensitive data sent over the Internet may be accessed by unauthorized third-parties. To prevent security problems, users may associate security requirements that must be enforced in essential tasks of the business process. This fact leads to the need of automation, because both functional and security requirements should be modeled, at high-level, and enforced, at execution level. This work proposes a cloud-based solution named BPA-Sec4Cloud that supports all phases of the security-aware business process automation, from its modeling to its deployment. The use of a cloud-based solution facilitates the deployment process because all needed resources are available in the cloud and ready to be used. In addition, the cloud is also used as a platform in order to provide specific services, such as translators, to support the automation process. In order to evaluate the BPA-Sec4Cloud, the solution was compared against existing solutions through the use of metrics related to the quality of generated artifacts. <s> BIB006 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Dealing with security is a central activity for todays organizations. Security breaches impact on the activities executed in organizations, preventing them to execute their business processes and, therefore, causing millions of dollars of losses. Security by design principles underline the importance of considering security as early as during the design of organizations to avoid expensive fixes during later phases of their lifecycle. However, the design of secure business processes cannot take into account only security aspects on the sequences of activities. Security reports in the last years demonstrate that security breaches are more and more caused by attacks that take advantage of social vulnerabilities. Therefore, those aspects should be analyzed in order to design a business process robust to technical and social attacks. Still, the mere design of business processes does not guarantee that their correct execution, such business processes have to be correctly implemented and performed. We propose SEcure Business process Engineering (SEBE), a method that considers social and organizational aspects for designing and implementing secure business processes. SEBE provides an iterative and incremental process and a set of verification of transformation rules, supported by a software tool, that integrate different modeling languages used to specify social security aspects, business processes and the implementation code. In particular, SEBE provides a new modeling language which permits to specify business processes with security concepts and complex security constraints. We evaluated the effectiveness of SEBE for engineering secure business processes with two empirical evaluations and applications of the method to three real scenarios. <s> BIB007 </s> A survey on automation of security requirements in service-based business processes <s> Translation of security requirements into executable configurations <s> Security is an important non-functional characteristic of the business processes used by organisations for the coordination of their activities. Nevertheless, the implementation of security at the operational level can be challenging due to the limited security expertise of process designers and the delayed consideration of security during process development. To overcome such issues, expert knowledge and proven security solutions can be captured in the form of process patterns, which can easily be reused and integrated to business processes with minimal security-related knowledge required. In this work we introduce process-level security patterns, each of which contains the main activities required for the operationalisation of different security requirements. The introduced patterns are then used as a component of an existing framework for the creation of secure business process designs, the application of which, is illustrated through a working example. A preliminary evaluation of the proposed patterns is conducted via a workshop session. <s> BIB008
This section focuses on initiatives related to the translation of security requirements into executable artefacts. Regarding automation, high-level security requirements have to be mapped to a set of executable resources, e.g., configuration files. How should this task be carried out? This issue is the central problem addressed in this section. The first work to be presented was proposed by BIB002 . The author introduces a model driven architecture (MDA)-based transformation process to translate high-level system models enriched with security requirements into executable level security artefacts. BIB002 aim to incorporate MDA concepts and design pattern ideas in the same approach, which can be used to guide the generation of the required security configuration files. To illustrate the strategy proposed by Menzel, Figure 8 shows a general overview of the proposed approach. This approach consists of three layers. Initially, security intentions are modelled in layer modelling. Next, the security intentions are transformed into a platform independent model (PIM) in layer PIM. This translation process also handles the mapping of security intentions into security constraints and the mapping of security profiles into security patterns. The resulting model is a PIM model. Finally, in layer web service layer, WS-security assertions are generated based on the security constraints and will be used as a basis to enforce the security requirements at the execution level. Two important points should be highlighted in the context of Menzel's work: • A policy meta-model is used to support the specification of security requirements. The author proposes a meta-model that serves as an abstraction layer for security process languages and standards. This strategy is essential to enable the generation of security configuration files in different policy standards and security enforcement resources; • Utilisation of security patterns. Design pattern is a well-known concept in several areas of computer science and Menzel proposed its usage because it provides reusable expert knowledge. The author recommends a security pattern approach based on a formalised meta-model. For example, security intentions are related to the security pattern 'problem' and the security constraints are related to the security pattern 'solution'. In this way, MDA and design patterns are used together to provide the desired solution. In summary, Menzel proposed an approach to define security requirements at modelling level and facilitate the transformation of these requirements into WS-SecurityPolicy security configurations. The business expert cannot only model the security intention at high-level but also translate it using resources like design patterns. The SOA Security Lab also adopts a model-driven approach, which helps to better present the general structure of the solution and the mapping strategy. However, the security actions are already pre-defined with related security properties and do not allow the addition of other properties or even the modification of an already defined one. BIB001 also proposed an interesting work on the translation of security requirements. The author introduced an approach for inserting business requirements into business processes with more MDA essential elements and more details in the translation architecture in comparison to BIB002 . Wolter et al.'s (2009) framework starts with the creation of the computation independent models (CIM), which are developed by business and security experts with the support of a particular modelling tool. The business process modelling step generates a computation-independent model. The creation of the CIM model is carried out by a process modelling tool BIB001 , which is a prototype that has a security and a business process editor. Using this tool, the business expert can generate a model enriched with security requirements used, in the CIM to PIM transformation, as input to produce platform independent security configurations. More precisely, platform specific security policies. These configurations are based on the MDA concept of PIMs. Next, specific configurations files for the enforcement of the security policies (more precisely, ready-to-deploy security policies) are generated and can be used at a low level (in conjunction with the executable process definition). Finally, the generated files are used as input by a SOA-based environment, which is responsible for executing the business process and enforcing the security actions using an execution engine and security enforcement modules. Wolter's work is close to SOA Security Lab BIB002 . The author detailed the collaborative environment used as a basis for the construction of the transformation framework. Next, some MDA concepts were used to guide the translation process, i.e., CIM to PIM and PIM to PSM transformations. A key point of this work is the utilisation of a method to check the correctness of the transformation. However, Wolter's approach does not use a service information in the translation process. In another relevant research initiative, BIB008 proposes the use of process-level security patterns to support the operationalisation of security requirements in business processes. These patterns, which can be considered reusable process fragments BIB008 can be integrated into business process models to enforce security requirements. The main idea is that the patterns should be generic enough to be instantiated by different security approaches and technologies. To support the proposed approach, Argyropoulos introduced a framework and this framework is composed of three components. One of these components is the model transformation component, which has transformation rules to enable the generation of a security-annotated process skeleton and a secure business process model. An interesting contribution is the proposition of a hybrid reference process model, which aims to capture the variability related to the possible security technologies. This idea is very interesting, however, the hybrid reference process model itself was not fully described, which prevents a more accurate analysis of its capabilities. BIB003 proposed another work related to the security automation. This work has three outstanding contributions: 1 proposition of an approach for the composition of non-functional concerns in composite web services 2 a toolset supporting this approach with several editors 3 a runtime architecture, with a code generator, for realising the modelled specification. In short, BIB003 proposed a theoretical automation approach along with a toolset. The proposed execution environment is shown in Figure 9 . The first relevant point to be observed in this figure is the presence of two modelling artefacts: BPMN business process and non-functional model. Some experts produce both artefacts with the aid of a modelling editor also proposed by BIB003 . After the modelling of the business process and the non-functional concerns, the translation takes place. The translator has been implemented as a model-to-model transformation based on the XTend language BIB003 . Despite being a promising approach, the translation process itself was not fully described. Also, there is not a tool to perform the translation process. These facts prevent an accurate analysis of the translation mechanisms. In another interesting research initiative, BIB007 and BIB005 introduce a novel approach to support automated generation of secure artefact-centric implementations. More specifically, meta-models are proposed to specify the mapping relationships between the modelling and execution levels. This initiative is the result of an academic and industrial collaboration, in which SecBPMN2 BIB007 was integrated into SAP River BIB004 , an industrial artefact-centric language. The translation process proposed by Salnitri is only focused on available SecBPMN2 security annotations and each one of these security annotations has a corresponding enforcement rule. Considering this context, there are specific rules for the following security requirements: integrity, authenticity, accountability, non-repudiation, auditability, confidentiality, privacy, binding of duties, separation of duties, availability and non-delegation BIB005 . It is possible to observe that Salnitri focused on a large number of security requirements, including availability and non-delegation, which are not considered in related research initiatives. Besides, the security translation rules were implemented in a prototype, which allows its actual use by practitioners. However, this prototype only focuses on the translation from SecBPMN2 and SAP River, which impose barriers to its adoption. Besides, as described by BIB005 , the code must be manually inserted for the execution of the security enforcement. Skeletons are generated, which must be completed with more accurate information like the needed cryptography algorithm. Finally,  and BIB006 introduce an integrated methodology and tooling to automate security-aware service-based business processes. One of the core elements of this work is the BPA-Sec translator, which is responsible for carrying out the necessary translations to generate the platform-independent and platform-specific artefacts. Some relevant characteristics of this initiative include the BPMN to WS-BPEL translation, decoupling from specific BPMN tools, decoupling from a particular WS-BPEL orchestration engine and decoupling from a specific security enforcement module. Inspired by the MDA approach, the BPA-Sec translator has two internal components: platform independent translator and platform specific translator. Figure 10 presents a general overview of this tool. The first component of the BPA-Sec translator, namely platform independent translator, is responsible for generating the needed platform-independent artefacts (related to the executable business process, service information and security information) that can be used in two situations: • The platform-independent artefacts are used directly as input to the platform specific translator to generate all required executable artefacts. This is the default flow of the BPA-Sec approach  . If the BPA-Sec environment natively supports the chosen execution-level tools (e.g., orchestration engine), the translations allows both the automation process and the enforcement of the business process and security requirements at low-level. • The platform-independent artefacts can serve as the basis for both implementing security-aware business processes and documentation purposes. Instead of directly generating executable configurations, the involved experts can work on the manual development of the business process and security actions. In this way, BPA-Sec Translator still useful when the BPA-Sec environment does not natively support the execution-level tools. Considering the standards adopted in the BPA-Sec translator, namely BPMN and WS-BPEL, the platform independent translator maps security annotated BPMN specifications into a platform-independent WS-BPEL along with service and security descriptions. The annotated business process specification (BPMN business process enriched with security and service information) goes through the parser module to generate the annotated BPMN intermediate artefact. Next, this artefact is used in the generation of three intermediate artefacts: service, security and WS-BPEL artefacts. These artefacts use Java classes to represent internal information. In fact, a particular package contains all classes utilised by the translation process to describe entities in the various standards. The second internal element of the BPA-Sec translator is the platform specific translator. Unlike the platform independent translator, its core translator has only two internal translators, namely specific BPMN to WS-BPEL translator and specific security translator. Meanwhile, there are only two serialisers: specific WS-BPEL serialiser and specific security serialiser. The service translator and the service serialiser are not needed because the service information is used by the specific BPMN to WS-BPEL translator to generate the platform specific WS-BPEL. The output of this translator is the platform specific artefacts, which are composed of a platform specific executable WS-BPEL artefact and platform specific security artefacts. At this point, it is pertinent to highlight that BPA-Sec proposes particular translation rules for the security actions properties. To have an automatic automation process, it is also necessary to consider the properties of security actions in the translation process. Otherwise, to generate specific code for the security action still possible, but this code has to be updated to set specific parameters that are fundamental not only to the security actions enforcement, but also to better define the desired level of these actions. For example, in a security action like cryptography, the key length has a relevant role, because of a short key length, e.g., 56 bits, is more insecure in comparison to a 256-bits key. If security actions properties are available in the translation process, it is reasonable to expect that richer configurations could be achieved. This fact is considered one of the main contributions of the BPA-Sec initiative, i.e., to consider security actions properties not only at modelling level but also in the translation process. Besides, BPA-Sec proposes both functional and security translation in the same approach, which is an interesting contribution. Table 2 presents a comparative overview of the initiatives introduced in this section. To compare them, three aspects have been considered: if the solution is based or inspired by the MDA, if they have contributions on the functional translation area, i.e., translation of high-level into executable business processes and if they are supported by tools (or a set of tools).