Security preferences specification and implementation in a service-based workflow

The development of web 2.0 increases the call for agile and simple Business process support. SOA (Service oriented Architecture) provides companies with a new model to build their IT applications around their business processes and combine them dynamically and flexibly with the services of partner companies. In this open and distributed context, it is required to implement an appropriate security at each service. So, during the composition of service, it will be good for user to specify the security preference to associate to each service. In this article we describe in a first step, the difficulty of using analytical risk methods such as EBIOS, Mehari and OCTAVE to specify the constraints of security to associate with services. Then we present the SOA and its security component, therefore start the service bus ESB will act as an intermediary between the client and service provider. In a second step, we develop our method that can lead to the specification of security and describe how it would be possible to specify these security constraints during the service composition.