Applying Security-Awareness to Service-Based Systems

A service-based system (SBS) dynamically composes third-party services to deliver comprehensive functionality. As adaptive systems, SBSs can substitute equivalent services within the composition if service operations or workflow requirements change. Substituted services must maintain the original SBS quality of service (QoS) constraints. In this paper, we add security as a QoS constraint. Using a model problem of a SBS system created for self-adaptive system technology evaluation, we demonstrate the applicability of security assurance cases and service security profile exchange to build in security awareness for more informed SBS adaptation.