![](bg2.png)
base application that has been specified independently
— i.e. the application does not contain any secu-
rity concern and the security model has been defined
generically in order to reuse it in several applications.
This is done automatically without manually modify-
ing the existing elements in the model of the base ap-
plication. To do this, we use the Common Variability
Language (CVL) (Haugen et al., 2012) in combina-
tion with the ATL Transformation Language (Jouault
et al., 2008). CVL allows us to specify and resolve the
variability of the security model, and also allows us to
weave the customized security model with the base
application using model transformation rules, auto-
matically generating the complete model of the appli-
cation with the security functionality. CVL includes
the possibility of delegating its control during vari-
ability resolution to a Model-2-Model (M2M) trans-
formation engine such as ATL, QVT (Query/View/-
Transformation), etc. The main contribution of this
paper is that we define a set of reusable weaving pat-
terns in CVL to incorporate each security concern in
the most suitable place (join point) of the base appli-
cation model. We define the semantic of each weav-
ing pattern using reusable ATL transformation rules
that are different for each security concern since each
of them need to be woven with the base application in
a different way.
The advantage of using CVL is that it allows us
to define the models in any language based on Meta-
Object Facility (MOF) meta-models. In this paper we
use the Unified Modeling Language (UML) to define
the models (software architectures as component dia-
grams) and the weaving patterns, but our proposal is
suitable for use with any MOF compliant language,
and the weaving patterns are reusable by defining a
previous model transformation between UML and the
language used to define the application and the se-
curity software architectures. In addition, the secu-
rity software architecture can also be reused with any
other application of the same domain by reusing the
model transformations.
In contrast to other variability techniques used by
traditional Software Product Lines (SPLs), such as
feature models that require an additional process to
generate the customized software architecture from
the feature model configuration, CVL is intended to
be used in conjunction with architectural models, re-
solving the variability and generating the architec-
tural configuration in the same process. Furthermore,
CVL was submitted to the Object Management Group
(OMG) as standard to model variability.
The rest of this paper is structured as follows. In
Section 2 we present the case study used throughout
the paper. Section 3 introduces our proposal using
CVL and briefly describes the CVL terminology. Sec-
tion 4 explains how we perform the configuration of
the security model and the weaving process. In Sec-
tion 5 we provide the weaving patterns for the security
concerns through model transformations. Section 6
surveys related work and in Section 7 we conclude
the paper and consider future directions.
2 CASE STUDY
Our case study is an electronic voting (e-voting) ap-
plication which is one of the demonstrators of the
INTER-TRUST project. E-Voting is one of the en-
vironments where security requirements are complex.
Figure 1 shows a simplified software architecture in
UML with the main functionality of an e-voting ap-
plication. This architecture does not include any com-
ponent related to the security requirements. The Voter
Application component allows clients to cast their
votes from smart phones, tablets, e-mails, etc. by us-
ing the EVotingInt interface. The Vote Server com-
ponent receives the votes and the Election Data stores
them in a digital ballot box through the VoteStorageInt
interface. Administrators can manage the election
data and get the election results through the VotingM-
ngInt interface that provides access to the functional-
ity of the Election Data and the Vote Counting compo-
nents.
Apart from the base functionality shown in Fig-
ure 1, the e-voting application requires a list of se-
curity extra-functional properties. Concretely, it is of
paramount importance to guarantee that: (1) all the
votes in the digital ballot box belong to an eligible
voter (i.e. integrity of the votes); (2) at the same time
the privacy of the voter must be preserved, even in
the counting process (i.e. votes must be protected by
means of cryptography); (3) the voter must be au-
thenticated using a personal digital certificate, such
an electronic ID card, and (4) administrators must be
authorized to perform actions over the election data.
With the goal of defining the security functionali-
ties once, and reusing them for several applications,
Figure 2 shows a UML software architecture with
the complete functionality of all the possible security
concerns. This includes the Integrity, Authentication,
Encryption, Authorization, and Digital Signature com-
ponents with all kinds of authentication mechanisms,
encryption algorithms, and the integrity, authoriza-
tion, and digital signature functionality.
3
However,
3
To simplify the case study we do not show all the ex-
isting security properties nor all the existing algorithms for
each concern.
AnAspect-OrientedModelTransformationtoWeaveSecurityusingCVL
139