WAVE: Automatic Verification of Data-Driven Web Services

Data-driven Web services, viewed broadly as interactive systems available on the Web for users and programs, provide the backbone for increasingly complex Web applications. While this yields everincreasing functionality, the added complexity renders such applications more vulnerable to bugs and failures, potentially compromising their robustness and correctness. Therefore, there is a need to develop verification techniques for such Web services. The WAVE project at UC San Diego aims to develop new approaches for automatic verification of data-driven Web services. The work relies on a novel, highly effective marriage of model checking and database techniques. We summarize briefly the main contributions of the project, which range from theoretical foundations to the successful implementation of a prototype verifier. 1 Verification of stand-alone data-driven Web services We first outline our results on verification of data-driven Web services for single peers in isolation, then dicsuss extensions of the results to compositions of Web services. We focus on services interacting with external users or programs through a Web browser interface, and accessing an underlying database. Such services include e-commerce sites, scientific and other domain-specific portals, e-government, etc. These Web sites are often governed by complex, data-dependent workflows, controlled by queries. The spread of such services has been accompanied by the emergence of tools for their high-level specification. A representative, commercially successful example is WebML [1], which allows to specify a Web application using an interactive variant of the E-R model augmented with a workflow formalism. The code for the Web application is automatically generated from the WebML specification. This not only allows fast prototyping and improves programmer productivity but also provides new opportunities for automatic verification. Indeed, our WAVE prototype automatically verifies a significant class of such services. Verification leads to increased confidence in the correctness of database-driven Web applications generated from high-level specifications, by addressing the most likely source of errors (the application’s specification, as opposed to the less likely errors in the automatic generator’s implementation). We focus on interactive Web sites generating Web pages dynamically by queries on an underlying database. The Web site accepts input from external users or programs, possibly subject to specified pre-conditions. It responds by taking some action, updating its internal state database, and moving to a new Web page determined Copyright 2008 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. Bulletin of the IEEE Computer Society Technical Committee on Data Engineering ∗Supported by the NSF under grant numbers IIS/0415257 and CAREER/0347968. Address: CSE 0404, UC San Diego, La Jolla, CA 92093-0404, USA