An Aspec -O ien ed Model T ans o ma ion o Wea e Secu i y using CVL
Jose-Miguel Ho cas, M´
onica Pin o and Lidia Fuen es
CAOSD G oup, Depa amen o de Lenguajes y Ciencias de la Compu aci´
on, Uni e si y o M´
alaga, M´
alaga, Spain
{ho cas, pin o, l }@lcc.uma.es
Keywo ds: Aspec -O ien a ion, ATL, CVL, Model T ans o ma ions, Secu i y, Va iabili y, Wea ing Pa e n.
Abs ac : In his pape , we combine he Common Va iabili y Language (CVL) and he ATL T ans o ma ion Language
o cus omize and inco po a e a gene ic secu i y model in o any applica ion ha equi es secu i y. Secu i y
spans a la ge se o conce ns such as in eg i y, enc yp ion o au hen ica ion, among o he s, and each conce n
needs o be inco po a ed in o he base applica ion in a di e en way and a di e en poin s o he applica ion.
We p opose a se o wea ing pa e ns using model ans o ma ions in ATL o au oma ically wea e he secu i y
conce ns wi h he base applica ion in an aspec -o ien ed way. Since di e en applica ions equi e di e en
secu i y equi emen s, he secu i y model needs o be cus omized be o e i s inco po a ion in o he applica ion.
We esol e he a iabili y o he secu i y p ope ies and implemen he wea ing p ocess in CVL. We use an
e- o ing case s udy o illus a e ou p oposal using he CVL app oach.
1 INTRODUCTION
In Componen -Based So wa e Enginee ing (CBSE),
he e a e p ope ies o an applica ion ha can be dis-
pe sed and eplica ed in se e al modules. Secu i y
is an example o hese p ope ies, which a e usu-
ally de ined in mul iple di e en componen s c oss-
cu ing he base unc ionali y o he applica ion. Fo
ins ance, access con ol is de ined in each compo-
nen ha needs o con ol he use igh s o use a e-
sou ce. An Aspec -O ien ed (AO) app oach aims o
achie e sepa a ion o c osscu ing conce ns and ad-
d esses he limi a ion o he adi ional so wa e ech-
nologies (e.g. CBSE, Objec -O ien ed P og amming)
o app op ia ely modula ize c osscu ing conce ns a
he di e en de elopmen s ages. F om he pe spec-
i e o AO, secu i y is a c osscu ing conce n he be-
ha io o which is angled and/o sca e ed wi h he
co e beha io o he applica ion being a ec ed by i .
Modeling secu i y sepa a ely om he a ec ed ap-
plica ion has many ad an ages: high eusabili y, low
coupled componen s, high cohesi e so wa e a chi-
ec u es. To bene i om hese ad an ages secu i y e-
qui emen s need o be aken in o accoun om ea ly
s ages in he de elopmen p ocess — i.e. a he a -
chi ec u al le el. Mo eo e , he so wa e a chi ec u e
modeling he secu i y unc ionali y should be de ined
sepa a ely om he so wa e a chi ec u e o he base
applica ions ha need i . Sepa a ing secu i y ela ed
conce ns om he applica ion base code is also he
main mo i a ion o he INTER-TRUST p ojec 1 ha
is unde de elopmen . Wi h his p ojec , he indus ial
pa ne s demand secu i y solu ions easily ins an iable
as pa o any applica ion. The app oach p esen ed in
his pape pu sues an answe o hese demands. How-
e e , secu i y spans a la ge se o conce ns, including
enc yp ion, au hen ica ion, access con ol, and au ho-
iza ion, among o he s, and each o hese conce ns
a ec s he base applica ion in a di e en way. Fo
ins ance, access con ol is pe o med be o e he exe-
cu ion o a es ic ed ac ion by he use , while enc yp-
ion is pe o med be o e sending a message h ough a
ne wo k in o de o enc yp he in o ma ion, bu also
a e ecei ing he message in he a ge in o de o de-
c yp he in o ma ion. Mo eo e , no all he applica-
ions equi e all he secu i y conce ns. A i s applica-
ion may equi e he in eg i y and he non- epudia ion
conce ns, a second applica ion may equi e only he
enc yp ion conce n, and a hi d applica ion may also
equi e he enc yp ion conce n bu using a di e en
enc yp ion algo i hm. The so wa e a chi ec u e o
hese applica ions should include only he necessa y
secu i y unc ionali y and he conce ns ha a e no
equi ed should no be pa o he inal a chi ec u e
o he applica ion.
In his pape , we ollow an Aspec -O ien ed Mod-
eling (AOM) app oach2 o inco po a e (wea e in he
AO e minology) a cus omized secu i y model in o a
1h p://www.in e - us .eu//
2h p://www.aspec -modeling.o g
base applica ion ha has been speci ied independen ly
— i.e. he applica ion does no con ain any secu-
i y conce n and he secu i y model has been de ined
gene ically in o de o euse i in se e al applica ions.
This is done au oma ically wi hou manually modi y-
ing he exis ing elemen s in he model o he base ap-
plica ion. To do his, we use he Common Va iabili y
Language (CVL) (Haugen e al., 2012) in combina-
ion wi h he ATL T ans o ma ion Language (Jouaul
e al., 2008). CVL allows us o speci y and esol e he
a iabili y o he secu i y model, and also allows us o
wea e he cus omized secu i y model wi h he base
applica ion using model ans o ma ion ules, au o-
ma ically gene a ing he comple e model o he appli-
ca ion wi h he secu i y unc ionali y. CVL includes
he possibili y o delega ing i s con ol du ing a i-
abili y esolu ion o a Model-2-Model (M2M) ans-
o ma ion engine such as ATL, QVT (Que y/View/-
T ans o ma ion), e c. The main con ibu ion o his
pape is ha we de ine a se o eusable wea ing pa -
e ns in CVL o inco po a e each secu i y conce n in
he mos sui able place (join poin ) o he base appli-
ca ion model. We de ine he seman ic o each wea -
ing pa e n using eusable ATL ans o ma ion ules
ha a e di e en o each secu i y conce n since each
o hem need o be wo en wi h he base applica ion in
a di e en way.
The ad an age o using CVL is ha i allows us
o de ine he models in any language based on Me a-
Objec Facili y (MOF) me a-models. In his pape we
use he Uni ied Modeling Language (UML) o de ine
he models (so wa e a chi ec u es as componen dia-
g ams) and he wea ing pa e ns, bu ou p oposal is
sui able o use wi h any MOF complian language,
and he wea ing pa e ns a e eusable by de ining a
p e ious model ans o ma ion be ween UML and he
language used o de ine he applica ion and he se-
cu i y so wa e a chi ec u es. In addi ion, he secu-
i y so wa e a chi ec u e can also be eused wi h any
o he applica ion o he same domain by eusing he
model ans o ma ions.
In con as o o he a iabili y echniques used by
adi ional So wa e P oduc Lines (SPLs), such as
ea u e models ha equi e an addi ional p ocess o
gene a e he cus omized so wa e a chi ec u e om
he ea u e model con igu a ion, CVL is in ended o
be used in conjunc ion wi h a chi ec u al models, e-
sol ing he a iabili y and gene a ing he a chi ec-
u al con igu a ion in he same p ocess. Fu he mo e,
CVL was submi ed o he Objec Managemen G oup
(OMG) as s anda d o model a iabili y.
The es o his pape is s uc u ed as ollows. In
Sec ion 2 we p esen he case s udy used h oughou
he pape . Sec ion 3 in oduces ou p oposal using
CVL and b ie ly desc ibes he CVL e minology. Sec-
ion 4 explains how we pe o m he con igu a ion o
he secu i y model and he wea ing p ocess. In Sec-
ion 5 we p o ide he wea ing pa e ns o he secu i y
conce ns h ough model ans o ma ions. Sec ion 6
su eys ela ed wo k and in Sec ion 7 we conclude
he pape and conside u u e di ec ions.
2 CASE STUDY
Ou case s udy is an elec onic o ing (e- o ing) ap-
plica ion which is one o he demons a o s o he
INTER-TRUST p ojec . E-Vo ing is one o he en-
i onmen s whe e secu i y equi emen s a e complex.
Figu e 1 shows a simpli ied so wa e a chi ec u e in
UML wi h he main unc ionali y o an e- o ing ap-
plica ion. This a chi ec u e does no include any com-
ponen ela ed o he secu i y equi emen s. The Vo e
Applica ion componen allows clien s o cas hei
o es om sma phones, able s, e-mails, e c. by us-
ing he EVo ingIn in e ace. The Vo e Se e com-
ponen ecei es he o es and he Elec ion Da a s o es
hem in a digi al ballo box h ough he Vo eS o ageIn
in e ace. Adminis a o s can manage he elec ion
da a and ge he elec ion esul s h ough he Vo ingM-
ngIn in e ace ha p o ides access o he unc ional-
i y o he Elec ion Da a and he Vo e Coun ing compo-
nen s.
Apa om he base unc ionali y shown in Fig-
u e 1, he e- o ing applica ion equi es a lis o se-
cu i y ex a- unc ional p ope ies. Conc e ely, i is o
pa amoun impo ance o gua an ee ha : (1) all he
o es in he digi al ballo box belong o an eligible
o e (i.e. in eg i y o he o es); (2) a he same ime
he p i acy o he o e mus be p ese ed, e en in
he coun ing p ocess (i.e. o es mus be p o ec ed by
means o c yp og aphy); (3) he o e mus be au-
hen ica ed using a pe sonal digi al ce i ica e, such
an elec onic ID ca d, and (4) adminis a o s mus be
au ho ized o pe o m ac ions o e he elec ion da a.
Wi h he goal o de ining he secu i y unc ionali-
ies once, and eusing hem o se e al applica ions,
Figu e 2 shows a UML so wa e a chi ec u e wi h
he comple e unc ionali y o all he possible secu i y
conce ns. This includes he In eg i y,Au hen ica ion,
Enc yp ion,Au ho iza ion, and Digi al Signa u e com-
ponen s wi h all kinds o au hen ica ion mechanisms,
enc yp ion algo i hms, and he in eg i y, au ho iza-
ion, and digi al signa u e unc ionali y.3Howe e ,
3To simpli y he case s udy we do no show all he ex-
is ing secu i y p ope ies no all he exis ing algo i hms o
each conce n.
Figu e 1: e-Vo ing so wa e a chi ec u e.
Figu e 2: Secu i y so wa e a chi ec u e.
he e- o ing applica ion only needs a pa icula con-
igu a ion o hese secu i y unc ionali ies based on
he p e ious secu i y equi emen s.
3 OUR PROPOSAL USING CVL
CVL is a domain-independen language o speci y-
ing and esol ing a iabili y. I makes he speci ica-
ion and esolu ion o a iabili y o e any ins ance o
models de ined using a MOF-based me a-model eas-
ie .
Figu e 3 shows ou p oposal using he CVL ap-
p oach. The co e so wa e a chi ec u e o ou base ap-
plica ion and he secu i y so wa e a chi ec u e wi h
all he secu i y unc ionali ies a e he Base Models
and can be de ined in any MOF-de ined language.
The speci ica ion o he a iabili y o he secu i y
conce ns is exp essed in an abs ac le el in he Va i-
abili y Model. The speci ica ion o conc e e a iabili y
in he secu i y model and he secu i y wea ing pa -
e ns o each secu i y conce n a e also de ined in he
a iabili y model. Di e en con igu a ions o he se-
cu i y model a e p o ided in he Resolu ion Models.
These con igu a ions a e selec ions o a se o choices
in he a iabili y model.
CVL p o ides an execu able engine o au oma i-
cally p oduce he Resol ed Models aking as inpu s
he a iabili y model, he esolu ion models and he
base models. In ou p oposal, he esol ed models
a e he so wa e a chi ec u e o he base applica ion
Figu e 3: Ou p oposal using he CVL app oach.
wo en wi h he eques ed secu i y con igu a ion. The
p ocess o de i ing a esol ed model om a base
model gi en a esolu ion model is called ma e ializa-
ion. Apa om esol ing a iabili y, he CVL en-
gine also has he capabili y o delega e i s con ol o a
M2M ans o ma ion engine. This is especially use ul
o de ining domain speci ic ac ions he seman ics o
which a e no de ined by CVL, and i is used in ou
p oposal o implemen he wea ing p ocess be ween
he applica ion a chi ec u e and he secu i y con igu-
a ion a chi ec u e by pe o ming models ans o ma-
ions du ing he execu ion o CVL.
In o de o implemen ou p oposal we use he ol-
lowing concep s o CVL4:
Va iabili y Speci ica ions (VSpecs). They a e pa
o he a iabili y model. They a e ee-based
s uc u es ep esen ing choices,5and can ha e
a ia ion poin s bound o hem. To ma e ialize a
base model wi h a a iabili y model o e i , eso-
lu ions o he VSpecs mus be p o ided. Choices
a e esol ed by deciding hem nega i ely o posi-
i ely.
Va ia ion Poin s. They a e pa o he a iabili y
model and de ine speci ic modi ica ions o be ap-
plied o he base model du ing ma e ializa ion.
They e e o base model elemen s ia base mod-
els handles and a e bound o VSpecs. The appli-
ca ion o he a ia ion poin s depends on he eso-
lu ion o he VSpecs.
Exis ence Va ia ion Poin . I is a kind o a ia ion
poin ha indica es he exis ence o a pa icula
objec , link, o alue in he base model. I s neg-
a i e applica ion in ol es dele ing elemen s om
he base model.
Opaque Va ia ion Poin (OVP). I is a kind o a i-
a ion poin he impac o which on he base model
is use -de ined h ough a model ans o ma ion
language. OVPs allow ex ending and cus omizing
he seman ic o he exis ing CVL a ia ion poin s.
4The comple e desc ip ion o CVL can be ound in
h p://www.omgwiki.o g/ a iabili y/.
5“Fea u es” in mos SPL app oaches.
The AO main concep s ha we use a e:
Join Poin . I is a poin in he model (e.g. a me hod
call in an in e ace) which can be a ec ed by he
c osscu ing beha io .
Ad ice. I is he addi ional beha io ha a ec s he
base p og am a he selec ed join poin s. The e
a e usually h ee kinds o ad ices based on ‘when’
he beha io akes place in e e ence o he join
poin s: be o e,a e , and a ound. A ound ad-
ices allow bypassing he execu ion o he cap-
u ed join poin s.
Poin cu . I is an exp ession ha desc ibes a se o
join poin s.
4 SECURITY WEAVING
In o de o inco po a e a pa icula con igu a ion o
he secu i y unc ionali y in o he base applica ion o
ou case s udy, we implemen he wea ing p ocess us-
ing CVL and, conc e ely, using he OVPs o CVL. Be-
o e ha , we need o cus omize he secu i y so wa e
a chi ec u e om he secu i y equi emen s o ou e-
o ing applica ion. Bo h p ocesses, he selec ion o a
secu i y con igu a ion and he wea ing a e pe o med
in he same s ep using CVL.
Figu e 4 shows an ins ance o ou p oposal us-
ing he CVL app oach wi h ou case s udy and he
secu i y speci ica ions. The a iabili y model o se-
cu i y is speci ied in an abs ac le el using VSpecs
( op o Figu e 4). Secu i y p ope ies a e decomposed
in o choices in he VSpecs, indica ing which secu-
i y conce ns a e op ional and which a e manda o y.
In ou case s udy, o simplici y, secu i y is decom-
posed only in o he choices o In eg i y,Access Con-
ol which in u n con ains he Au hen ica ion and Au-
ho iza ion conce ns, and C yp og aphy ha con ains
he Enc yp ion and Digi al Signa u e conce ns. Each
o hem is also composed by he a ailable me hods
and algo i hms. Fo ins ance, he e a e h ee kinds o
me hods o e i y he in eg i y o he da a: Passwo d
e i ica ion,Da a iden i ie , and Hash e i ica ion. The
las one can be pe o med by using he MD5 o he
SHA-1 algo i hm. The esolu ion o all hese choices
equi e a yes/no decision, and he secu i y con igu a-
ion ( he esolu ion model) is a selec ion o his se o
choices in he VSpecs — i.e. he secu i y conce ns
ha a e decided posi i ely (da kened choices in Fig-
u e 4).
The conc e e a iabili y o secu i y and he wea -
ing pa e ns a e speci ied using a ia ion poin s (mid-
dle o Figu e 4): “objec exis ence” a ia ion poin s
o ealize he a iabili y and OVPs o do he wea -
Figu e 4: Secu i y con igu ing and wea ing using CVL.
ing. The objec exis ence a ia ion poin s a e bound o
choices o he VSpecs and e e o componen s o he
secu i y so wa e a chi ec u e (bo om o Figu e 4).
This kind o a ia ion poin indica es he exis ence o
a pa icula objec (componen ) ha will be included
o emo ed om he secu i y so wa e a chi ec u e
based on he esolu ion p o ided o he associa ed
VSpec. Fo ins ance, he a ia ion poin bound o
he In eg i y conce n in he VSpecs (:Objec Exis ence)
indica es ha i he In eg i y choice is decided posi-
i ely (i.e. is selec ed in he esolu ion model) in a
con igu a ion, he ela ed elemen s ( he In eg i y com-
ponen and i s in e aces wi h hei a achmen s) in
he secu i y so wa e a chi ec u e will exis in he e-
sol ed model and i in eg i y is decided nega i ely
(i.e. is no selec ed in he esolu ion model) hose
ela ed elemen s will be emo ed om he esol ed
model.
The OVPs a e also bound o he VSpecs bu ha e
wo o mo e e e ences in he base models: (1) one
e e ence (sou ce objec s) o he in e ace in he secu-
i y so wa e a chi ec u e he beha io o which we
wan o inco po a e in ou base applica ion — i.e.
he ad ice, and (2) one o mo e e e ences ( a ge
objec s) o he in e aces in he applica ion so wa e
a chi ec u e whe e we wan o inco po a e he secu-
i y conce n — i.e. he join poin s. Fo ins ance,
OVP2 has a e e ence (sou ceObjec ) o he Enc yp-
ionIn in e ace in he secu i y model and wo a ge s
( a ge Objec s): one o enc yp ing ( ha e e ences
o he E o ingIn in e ace in he applica ion model)
and one o dec yp ing ( ha e e ences o he Vo ing-
Da aIn in e ace).
OVPs a e also bound o an OVPType, whe e his
ype explici ly de ines he seman ic o he special sub-
s i u ion — i.e. he ans o ma ion ules o wea e he
secu i y conce ns in o he base applica ion. Each se-
cu i y conce n needs o be wo en wi h he base ap-
plica ion ollowing a di e en ans o ma ion pa e n
based on he aspec ual in o ma ion o he conce n: he

kind o he ad ice ha he conce n implemen s: be-
o e,a e , o a ound; he me hod (ad ice) ha mus
be execu ed by he conce n; and he in e cep ed me h-
ods (join poin s) in he base applica ion. So, using
CVL we need o use se e al a ia ion poin s, wi h
di e en seman ics, o indica e how he elemen s o
he models a e adap ed in o de o gene a e he e-
sol ed model. Du ing a iabili y ma e ializa ion, he
CVL engine will delega e i s con ol o a M2M ans-
o ma ion engine (ATL in ou p oposal) whene e i
encoun e s an OVP. The M2M ans o ma ion engine
execu es he seman ic speci ica ion associa ed wi h
he OVP and esol es he a iabili y acco dingly.
The esol ed model is au oma ically gene a ed
(Figu e 5) and he secu i y con igu a ion is wo en
wi h ou applica ion so wa e a chi ec u e: he com-
ponen s ela ed o he secu i y conce ns a e clea ly
isible in he s a ic pa o he a chi ec u e, and he
ela ionships be ween he secu i y elemen s and he
elemen s o he base applica ion (“c osscu s” depen-
dency ela ionship) explici ly indica e ha he sou ces
o he ela ionships c osscu he a chi ec u al le el,
and he a ge s a e he poin o he applica ion whe e
hey ake place. Howe e , he aspec ual in o ma ion
wi h he in e ac ions be ween he componen s is no
ep esen ed in he so wa e a chi ec u e o Figu e 5.
To comple e he design we complemen he so wa e
a chi ec u e wi h a se o sequence diag ams ha ep-
esen he aspec ual in o ma ion and ha a e also au-
oma ically gene a ed by he wea ing pa e ns (Pin o
e al., 2009). The ollowing sec ion shows he wea -
ing pa e ns, in de ail, o each secu i y conce n.
5 SECURITY WEAVING
PATTERNS
The na u e o each secu i y conce n a oids ha ing o
ha e a unique and homogeneous wea ing pa e n. As
we explained in he p e ious sec ion each conce n
needs di e en aspec ual in o ma ion and he wea -
ing pa e ns (i.e. he ans o ma ion ules) needed o
pe o m he wea ing a e di e en .
The seman ic speci ica ion associa ed wi h each
OVP mus include ans o ma ion ules o: (1) in-
co po a e he secu i y componen s in o he so wa e
a chi ec u e o he base applica ion; (2) c ea e he
“c osscu s” ela ionships be ween he in e ace o he
conce n ( he ad ice) and he in e ace o he applica-
ion whe e he c osscu s ake places ( he join poin );
and (3) gene a e he sequence diag am ha ep esen s
he beha io o he c osscu ing ela ionship.
We de ine a se o ATL ans o ma ions o each
o he secu i y conce ns: au hen ica ion, enc yp ion,
au ho iza ion, in eg i y, and digi al signa u e. Wea -
ing pa e ns o o he secu i y o c osscu ing con-
ce ns may be de ined in a simila way. To pe o m
he wea ing be ween he models, each ATL ans o -
ma ion akes as inpu he wo models ( he applica ion
model and he secu i y model) and gene a es as ou pu
he same applica ion model wi h he app op ia e secu-
i y conce n me ged. The elemen s o he applica ion
model emain unchanged in he ou pu model. So, we
can ocus on he gene a ion o he secu i y elemen s
in he ATL ans o ma ions.
The ans o ma ion ules (wea ing pa e ns) a e
de ined only once and can be eused in each appli-
ca ion. Howe e , he e is speci ic in o ma ion o he
base applica ion ha he so wa e a chi ec mus p o-
ide because i is di e en o each applica ion. Fo
ins ance, he so wa e a chi ec mus de ine he con-
c e e poin cu s (e.g. he me hod signa u e) o he
join poin s in he base applica ion. To simpli y he
case s udy, we only use me hod call/execu ion poin -
cu designa o s. In o de o make he ans o ma ion
ules mo e eusable, we de ine he aspec ual in o ma-
ion as a ibu es (helpe s) in ATL ha mus be illed
in o each applica ion wi h he signa u e o he in e -
cep ed me hod by he c osscu ela ionship.
5.1 Au hen ica ion
The seman ic o he special subs i u ion o he au-
hen ica ion conce n is shown in he Lis ing 1. The
ans o ma ion ule: (1) copies he au hen ica ion se-
cu i y elemen s: he componen (sou ceComp) and
in e ace (sou ceIn ) om he Secu i yModel o he
applica ion model (AppModel in he ule); (2) c e-
a es he “c osscu ” ela ionship be ween he sou ce
(sou ceIn ) and he a ge ( a ge In ) in e aces; and
(3) gene a es he sequence diag am wi h he in e ac-
ions be ween he au hen ica ion and he base applica-
ion elemen s.
The aspec ual in o ma ion is coded in he ans-
o ma ion pa e n and is used o gene a e he in e -
ac ions. Fo ins ance, o gene a e he au hen ica ion
sequence diag am we use a called ule o ATL wi h
he aspec ual in o ma ion: he in e cep ed me hod
o e(Objec ) (p o ided wi h he helpe ope a ion), he
ad ice (‘au hen ica e()’), and he kind o he ad ice
(‘a ound’), apa om he in e aces and componen s
ela ed.
The sequence diag am gene a ed is shown in
Figu e 6. Au hen ica ion is usually pe o med be o e
a me hod call, howe e we use an a ound ad ice in
o de o abo he call o he me hod o e(Objec ) i
he au hen ica ion ails.
Figu e 5: Applica ion wi h secu i y unc ionali y wo en.
Lis ing 1: Seman icSpec1 (SpecialSubs i u ionAu hen)
module au hen ica ion;
c ea e OUT : U ML om AppModel:UML,
Sec u i yMod el : UML ;
ule Au hen ica ion {
om so u ce In : UML ! In e ace in Secu i yModel ,
sou ceC omp : UML ! Compo nen in Secu i yModel ,
a g e In : UML ! In e ace in AppModel ,
( so u ceIn . name = ‘ Au hen ica ionIn ’ and
sou c eCom p . na me = ‘ A u h en ic a ion ’ a nd
a ge In . nam e = hisModule. a ge O bjec )
o sec u i yC om p : UML ! Co mp on en ( ... ) ,
sec u i yIn : UML ! In e ac e (... ) ,
c o ss cu A ss oc : UML ! D ep ende ncy (
clien <- sou ceIn ,
supplie <- a ge In , ...)
do {c osscu Assoc.applyS e eo ype(
hisModule. g e S e e o yp e ( ‘ c os sc u s ’) ) ;
hisModule. C e a eAu hI n e ac i on ( a ge In ,
sou ceIn , sou ceComp , ‘a ound ’,
hisModule. o pe a i on , ‘ a u h en i ca e () ’) ;}
}
5.2 Enc yp ion
The seman ic o he special subs i u ion o he en-
c yp ion conce n (Lis ing 2) is di e en since i
uses wo di e en ad ices (‘enc yp (Objec )’ and ‘de-
c yp (Objec )’) in wo di e en poin s o he appli-
ca ion. The o es a e enc yp ed in he o e(Objec )
me hod o he EVo ingIn in e ace (p o ided by
he ope Enc yp helpe ), and a e dec yp ed in he
ge Vo e() me hod o he Vo ingDa aIn in e ace (p o-
Figu e 6: Au hen ica ion sequence diag am.
ided by he ope Dec yp helpe ). The ans o ma ion
ule au oma ically gene a es wo di e en sequence
diag ams wi h ha in o ma ion: one o enc yp ing
(Figu e 7) and one o dec yp ing (Figu e 8).
Lis ing 2: Seman icSpec2 (SpecialSubs i u ionEnc yp )
module enc yp ion ;
c ea e OUT : U ML om AppModel:UML,
Sec u i yMod el : UML ;
ule Enc yp ion {
om so u ce In : UML ! In e ace in Secu i yModel ,
sou c eC omp : UML ! Compo nen in Secu i yModel ,
a ge E nc y pIn : UM L ! In e ace in AppModel ,
a ge D ec y pIn : UM L ! In e ace in AppModel ,
( so u ceIn . name = ‘ Enc yp ionIn ’ and
s ou c eC om p . n ame = ‘ E nc yp io n ’ an d
a ge D ec ypI n . name = hisModule.
a ge Obje c 1 and
a ge E nc y p In . name = hisModule.
a ge Obje c 2 )
o sec u i yC om p : UML ! Co mp on en ( ... ) ,
sec u i yIn : UML ! In e ac e (... ) ,
c o ss cu A ss oc1 : UML ! D epen denc y (
clien <- sou ceIn ,
supplie <- a ge Enc yp In , ...),
c o ss cu A ss oc2 : UML ! D epen denc y (
clien <- sou ceIn ,
supplie <- a ge Dec yp In , ...)
do {c osscu Assoc1.applyS e eo ype(
hisModule. g e S e e o yp e ( ‘ c os sc u s ’) ) ;
c osscu Assoc2.applyS e eo ype(
hisModule. g e S e e o yp e ( ‘ c os sc u s ’) ) ;
hisModule. C ea eEn c yp In e ac ion (
a ge Enc yp In , sou ceIn , sou ceComp ,
‘a ound ’, hisModule.ope Enc yp ,
‘ enc yp ( Objec ) ’);
hisModule. C ea eEn c yp In e ac ion (
a ge Dec yp In , sou ceIn ,
sou ceComp , ‘ a ound ’,
hisModule.ope Dec yp ,
‘ dec yp ( Objec ) ’) ;}
}
Figu e 7: Enc yp ion sequence diag am o enc yp ing.
Figu e 8: Enc yp ion sequence diag am o dec yp ing.
5.3 Digi al Signa u e
The wea ing pa e n o he digi al signa u e conce n
is e y simila o he enc yp ion pa e n, bu we only
need he ‘sign(Objec )’ ad ice. We use an a e ad ice
o sign he o es in he se e side a e sending hem
in o de o p e en de ice clien s wi h lowe esou ces
om cas ing hei o es. The sequence diag am o
Figu e 9 shows ha he ad ice ‘sign(Objec )’ is pe -
o med a e he execu ion o he me hod o e(Objec ).
Figu e 9: Digi al signa u e sequence diag am.
5.4 In eg i y
The in eg i y conce n gua an ees he o es belong o
an eligible o e . The wea ing pa e n is also simila
o he enc yp ion pa e n. We use an a ound ad ice
o e he me hod s o eVo e(Objec ) o he Vo ingS o -
eIn in e ace wi h he pu pose o e i ying he au-
hen ici y o he o e and ejec ing i i he o e be-
longs o an in alid o e (see he sequence diag am o
Figu e 10).
Figu e 10: In eg i y sequence diag am.
5.5 Au ho iza ion
The au ho iza ion wea ing pa e n is simila o he au-
hen ica ion case, and in mos secu i y app oaches he
au ho iza ion conce n is based on di e en au hen i-
ca ion mechanisms. In ou e- o ing applica ion we
use a be o e ad ice in o de o g an o deny pe mis-
sions o access p i ileged da a o he elec ion p ocess.
The sequence diag am (Figu e 11) shows ha he au-
ho iza ion logic e i ies he pe missions o he ad-
minis a o be o e calling any me hod o he Vo ingM-
ngIn in e ace.
6 RELATED WORK
Secu i y is usually achie ed in se e al ways, bu mos
o he app oaches p esen he secu i y as a se o non-
Figu e 11: Au ho iza ion sequence diag am.
unc ional p ope ies, ins ead o ocusing on he unc-
ional pa o he secu i y conce ns as we do. Fo in-
s ance, in (Geo g e al., 2002), he au ho s analyze he
impac o secu i y p ope ies on o he unc ional con-
ce ns o he base applica ion using an AO app oach.
Model D i en Enginee ing (MDE) has also been
used in he ield o SPLs (Sij ema, 2010). Sij ema
p oposes a s a egy o le ATL handle he a iabili y
by ex ending he conc e e syn ax o ATL wi h he con-
cep o a iabili y ules. Va iabili y ules a e used in
he con ex o a ans o ma ion sequence which suc-
cessi ely e ines models. Howe e , hey i s model
he a iabili y sepa a ely in a ea u e diag am and
ha e o make he co espondence be ween he ea u e
selec ions and he ealiza ion o he a e ac s. In com-
pa ison wi h ou p oposal, using CVL we model he
a iabili y and bind he ea u es di ec ly o he ele-
men s in he so wa e a chi ec u e. We use he basic
ATL wi hou he need o ex end i , bu ou p oposal
can also be used wi h o he ans o ma ion languages
such as QVT o ETL (Epsilon T ans o ma ion Lan-
guage) (Kolo os e al., 2008).
Recen ly, CVL has been applied in mul iple ap-
p oaches. Fo ins ance, CVL is used o manage
he a iabili y in he con ex o so wa e p ocesses
(Rouill´
e e al., 2012), business p ocess (Ayo a e al.,
2012), o e en o syn hesizing an SPL using model
compa ison (Zhang e al., 2011). In (Combemale
e al., 2012) CVL is used o speci y and esol e he
a iabili y o a so wa e design, and he Reusable
Aspec Model (RAM) echnique is used o speci y
and compose he de ailed s uc u al and beha io al
design models co esponding o he chosen a ian s.
Ou app oach, in con as , ocuses on he a chi ec u al
le el in he de elopmen p ocess, and we pe o m he
wea ing p ocess wi h he CVL engine, ins ead o us-
ing an ex e nal RAM wea e .
7 CONCLUSIONS AND FUTURE
WORK
We ha e de ined a se o secu i y wea ing pa e ns
h ough model ans o ma ions in ATL ha allows
he au oma ic inco po a ion o a cus omized secu i y
model in o he base applica ion model by using CVL
and AOSD. CVL makes ou p oposal sui able o use
wi h any MOF based model. We ha e implemen ed
ou p oposal and used i wi h se e al case s udies such
as he e- o ing applica ion p esen ed in his pape o
in a ehicle- o- ehicle and ehicle- o-in as uc u e
applica ion ha is ano he o he demons a o s o he
INTER-TRUST p ojec . In all cases, we ha e used
UML as he modeling language o he so wa e a chi-
ec u es and we conclude ha ou p oposal imp o es
he modula i y and eusabili y o bo h so wa e a chi-
ec u es, he co e a chi ec u e o he applica ion and
he secu i y so wa e a chi ec u e.
As pa o ou u u e wo k, we plan o make he
ans o ma ion ules mo e eusable by using a hi d
binding model in he wea ing pa e ns (Du ´
an e al.,
2013). The binding model allows de ining he aspec-
ual in o ma ion (e.g. poin cu de ini ions, ad ices)
as ex e nal pa ame e s o use hem in he ans o ma-
ion ules independen ly om he inpu models. We
also plan o ake in o accoun he exis ing dependen-
cies be ween he secu i y conce ns (e.g. au hen ica-
ion is usually needed by he au ho iza ion conce n),
and how hese dependencies a ec he wea ing pa -
e ns and he sequence diag ams when wo o mo e
conce ns a e applied in he same poin o he appli-
ca ion. Mo eo e , we plan o de ine wea ing pa e ns
o o he c osscu ing conce ns such as usabili y, pe -
sis ence, con ex -awa eness, e c.
ACKNOWLEDGEMENTS
Wo k suppo ed by he Eu opean P ojec INTER-
TRUST 317731 and he Spanish P ojec s TIN2012-
34840 and FamiWa e P09-TIC-5231.
REFERENCES
Ayo a, C., To es, V., Pelechano, V., and Al ´
e ez, G. H.
(2012). Applying CVL o business p ocess a iabil-
i y managemen . In P oceedings o he VARiabili y
o You Wo kshop: Va iabili y Modeling Made Use-
ul o E e yone, VARY ’12, pages 26–31, New Yo k,
NY, USA. ACM.
Combemale, B., Ba ais, O., Alam, O., and Kienzle, J.
(2012). Using CVL o Ope a ionalize P oduc Line