AVANTSSAR · Automated Validation of Trust and Security of Service-oriented Architectures

Driven by rapidly changing requirements and business needs, IT systems and applications are undergoing a paradigm shift: components are replaced by services, distributed over the network, and composed and reconfigured dynamically in a demand-driven way into service-oriented architectures. Exposing services in future network infrastructures entails a wide range of trust and security issues. Solving them is extremely hard since making the service components trustworthy is not sufficient: composing services leads to new subtle and dangerous vulnerabilities due to interference between component services and policies, the shared communication layer, and application functionality. Thus, one needs validation of both the service components and their composition into secure service architectures. AVANTSSAR proposes a rigorous technology for the formal specification and Automated VAlidatioN of Trust and Security of Service-oriented ARchitectures. This technology will be automated into an integrated toolset, the AVANTSSAR Validation Platform, tuned on relevant industrial case studies. The project will develop:<br/>- ASLan, the first formal language for specifying trust and security properties of services, their associated policies, and their composition into service architectures.<br/>- Automated techniques to reason about services, their dynamic composition, and their associated security policies into secure service architectures.<br/>- The AVANTSSAR Validation Platform, an automated toolset for validating trust and security aspects of service-oriented architectures.<br/>- A library of validated composed services and service architectures, proving that our technology scales to envisaged applications.<br/>Migrating project results to industry and standardisation organisations will speed up the development of new network and service infrastructures, enhance their security and robustness, and increase the public acceptance of emerging IT systems and applications based on them.