Dynamic Weaving of Security Aspects in Service Composition

Web service composition is to construct complex service through combining available services components as request. Service composition often has to handle the security risk that can not be predicted when the service components are developed. This paper presents an aspect-oriented (AO) approach to enhance the security of service composition that can not only realize flexible security policies but also accomplish it with very little run-time overhead. The security control is separated from other functional requirements and encapsuled into service extension aspect. And the composition can be extended by weaving the extension at runtime. It also gives the service composer a chance to unify security policy in composed service by specifying appropriate security extension himself. A Web service extension environment (WSXE) is devised to demonstrate the approach. Finally, an application of performing user-defined access control dynamically at runtime is given to exemplify the dynamic extension to service composition