RESTsec: a low-code platform for generating secure by design enterprise services

ABSTRACT

In the modern business world it is increasingly often that Enterprises opt to bring their business model online, in their effort to reach out to more end users and increase their customer base. While transitioning to the new model, enterprises consider securing their data of pivotal importance. In fact, many efforts have been introduced to automate this ‘webification’ process; however, they all fall short in some aspect: a) they either generate only the security infrastructure, assigning implementation to the developers, b) they embed mainstream, less powerful authorisation schemes, or c) they disregard the merits of the dominating REST architecture and adopt less suitable approaches. In this paper we present RESTsec, a Low-Code platform that supports rapid security requirements modelling for Enterprise Services, abiding by the state of the art ABAC authorisation scheme. RESTsec enables the developer to seamlessly embed the desired access control policy and generate the service, the security infrastructure and the code. Evaluation shows that our approach is valid and can help developers deliver secure by design enterprise services in a rapid and automated manner.

KEYWORDS:

• RESTful services
• model driven engineering
• ABAC
• access control
• data migration

Disclosure statement

No potential conflict of interest was reported by the authors.

Notes

1. https://goo.gl/a9aL6Q.

2. http://www.django-rest-framework.org.

3. http://rubyonrails.org.

4. https://en.wikipedia.org/wiki/Basic_access_authentication.

5. https://en.wikipedia.org/wiki/OAuth.

6. https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml.

7. http://csrc.nist.gov/projects/abac/.

8. https://goo.gl/QgPUDz.

9. https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml.

10. http://www.omg.org/spec/RAD/.

11. https://docs.oracle.com/javase/8/docs/technotes/guides/security/jaas/JAASRefGuide.html.

12. https://en.wikipedia.org/wiki/Role-based_access_control.

13. http://orbac.org.

14. https://www.owasp.org/index.php/Main_Page.

15. http://www.omg.org/spec/OCL/.

16. https://www.salesforce.com.

17. https://www.caspio.com.

18. http://agilepoint.com/.

19. http://www.appian.com.

20. https://www.mendix.com.

21. https://www.outsystems.com.

22. http://csrc.nist.gov/projects/abac/.

23. http://csrc.nist.gov/projects/abac/.

24. https://en.wikipedia.org/wiki/Discretionary_access_control.

25. https://en.wikipedia.org/wiki/Role-based_access_control.

26. https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml.

27. https://martinfowler.com/articles/richardsonMaturityModel.html.

28. https://projects.eclipse.org/projects/modeling.mmt.

29. https://goo.gl/evoux3.

30. http://www.omg.org/mda/.

31. CIM, PIM and PSM are the three distinct phases followed in MDA. CIM refers to the Computationally Independent Model that only comprises problem domain concepts, PIM refers to the Platform Independent Model that on top of CIM concepts introduces an abstract architecture of the system, which is then specialized to the target platform at the PSM or the Platform Specific Model .

32. https://en.wikipedia.org/wiki/Basic_access_authentication.

33. https://en.wikipedia.org/wiki/HATEOAS.

34. The CRUD verbs comprise the: Create verb that is used to create a new resource, Read verb that is used to retrieve an existing resource and the Update and Delete ones that are used to update and delete an existing resource respectively.

35. https://en.wikipedia.org/wiki/Basic_access_authentication.

36. https://github.com/AuthEceSoftEng/abac-mde-teis.

37. http://model.webofthings.io/.