Abstract

Service Oriented Architectures with underlyingtechnologies like web services and web services orchestrationhave opened the door to a wide range of novel applicationscenarios, especially in the context of inter-organizationalcooperation. One of the remaining obstacles for a widespreaduse of these techniques is security. Companies andorganizations open their systems and core business processesto partners only if a high level of trust can be guaranteed.The emergence of web services security standards providesa valuable and effective paradigm for addressing the securityissues arising in the context of inter-organizationalcooperation. The low level of abstraction of these standardsis, however, still an unresolved issue which makes theminaccessible to the domain expert and remains a majorobstacle when aligning security objectives with the customerneeds. Their complexity makes implementation easily proneof error. The SECTET – a model-driven security engineeringframework for B2B-workflows – facilitates the design andimplementation of secure inter-organizational workflows.This contribution has three objectives. First we present ahigh-level domain specific language – called SECTET-PL.Being part of the SECTET-framework, SECTET-PL is a policylanguage influenced by Object Constraint Language andinterpreted in the context of UML models.We then detail theMeta Object Facility based metamodels for the integrationof business requirements with the security requirements.Finally, using Model Driven Architecture paradigm, wedescribe the transformation of high-level security modelsto low-level web services standard artefacts with the help ofEclipse Modelling Framework and Open Architecture Ware.