Recognition and validation of security patterns

安全模式的识别和验证

• 批准号: 269496544
• 负责人: Professor Dr. Rainer Koschke
• 金额: --
• 依托单位: Technologie-Zentrum Informatik und Informationstechnik (TZI)
• 依托单位国家: 德国
• 项目类别: Research Grants
• 财政年份: 2015
• 资助国家: 德国
• 起止时间: 2014-12-31 至 2020-12-31
• 项目状态: 已结题
• 来源: https://gepris.dfg.de/gepris/projekt/269496544?language=en
• 关键词: Recognition; validation; security; patterns

Information security is increasingly gaining importance in software engineering. Developers are facing security issues during the design and evolution of software. Analogously to the well known design patterns, so called securitypatterns were proposed to provide solutions to recurring softwaredesign problems, yet with the focus on security issues.Our projects aims at detecting and validating relevant securitypatterns in programs. We will develop a method and a supportingsemi-automated tool to better support security reviews. In order to identify relevant security patterns and further understand their role in software design and security audits, we will conduct studies with security experts and developers.

信息安全在软件工程中越来越重要。开发人员在软件的设计和演进过程中面临着安全问题。类似于著名的设计模式，所谓的安全类型是为了提供解决反复出现的软件设计问题的解决方案，但重点是安全问题。我们的项目旨在检测和验证程序中相关的安全类型。我们将开发一种方法和一个支持半自动工具来更好地支持安全审查。为了找出相关的安全模式，并进一步了解它们在软件设计和安全审计中的作用，我们将与安全专家和开发人员进行研究。

项目成果

Automatically Extracting Threats from Extended Data Flow Diagrams

• DOI: 10.1007/978-3-319-30806-7_4
• 发表时间: 2016-04
• 作者: Bernhard J. Berger;K. Sohr;R. Koschke

The Architectural Security Tool Suite — ARCHSEC

架构安全工具套件 – ARCHSEC

• DOI: 10.1109/scam.2019.00035
• 发表时间: 2019
• 期刊: 2019 19th International Working Conference on Source Code Analysis and Manipulation (SCAM)
• 作者: Berger;Bernhard J. ;Koschke
• 通讯作者: Koschke

Towards supporting software assurance assessments by detecting security patterns

通过检测安全模式来支持软件保障评估

• DOI: 10.1007/s11219-019-09492-z
• 发表时间: 2020
• 期刊: Software Quality Journal
• 影响因子: 1.9
• 作者: Michaela ;Karsten
• 通讯作者: Karsten