SMS: Aspect-oriented Security Engineering