A Novel Approach to Generate the Property for Web Service Verification from Threat-Driven Model

Web service is considered as one of the most promising computing parad igms, which works as plugin mode to provide the value-added applications in Service-Oriented Computing (SOC) and Serv ice-Oriented Architecture (SOA). The general Web service verification focuses on functionality and its termination, such as deadlock o r livelock. However, it might not be able to help in accurately understanding service behaviours because it lacks interaction verifica tions, especially temporal behaviours. To this point, automatically generating proper temporal logic formulae of verification property is a p rimary and important task since the manual property generation is time-consuming and error-prone. Thus, this paper proposes an ap proach extending UML as service threat-driven model to generate the verification property, including the features of functionality, time constr aints and probability during service interactions. First, it introduces a scenario description tool, mainly Probabilistic Timed Live Seq uence Chart (PTLSC), on which kinds of implication threats are discussed, specifying the insecure behaviours which shou ld be prohibited from occurring in Web service. Second, it gives corresponding transformation methods to extract the verification prope rty from threat-driven model, in which the message coverage criterion and partial relation are employed. These formulae are in the for m of Probabilistic Timed Computation Tree Logic (PTCTL), which afford an underlying guideline to guarantee the correctness and r eliability of Web service since its threat-carried characteristics.