A discussion on security typing and measurement for SOA

  • Authors:

  • Frank Tsui;Andy Wang;Kai Qian

  • Affiliations:

  • Southern Polytechnic State University, Marietta, Georgia;Southern Polytechnic State University, Marietta, Georgia;Southern Polytechnic State University, Marietta, Georgia

  • Venue:
  • ACM SIGSOFT Software Engineering Notes
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

In a service oriented environment, using SOA technologies, different business entities and services are combined together. Such an environment introduces various security vulnerabilities. This paper proposes an innovative approach to address SOA application security through security typing. We first define security typing concepts, its declaration and definition, with a simple security type, SST, as an example. We then explore various operations under this concept including type equivalence, type compatibility, and type inference. We show, through unary and binary operational examples, that measuring security characteristics requires a clear understanding of the metric scale level and that often times extending an ordinal scale metric to ratio level can be misleading. Our idea and approach to SST may be generalized in the future to more sophisticated security typing.