Aspect-Oriented Modeling for Representing and Integrating Security Concerns in UML

Security is a challenging task in software engineering. Enforcing security policies should be taken care of during the early phases of the software development life cycle to more efficiently integrate security into software. Since security is a crosscutting concern that pervades the entire software, integrating security solutions at the software design level may result in the scattering and tangling of security features throughout the entire design. To address this issue, we present in this paper an aspectoriented modeling approach for specifying and integrating security solutions into UML design models. In the proposed approach, security experts specify high-level and generic security solutions that can be later instantiated by developers, then automatically and transparently woven into UML design. Finally, we describe our prototype implemented as a plug-in in a commercial software development environment.