Unifying security and software Product family models to enhance information confidentiality

点击翻译按钮获取中文摘要

Security and, in particular, information confidentiality are becoming more and more valuable to governments, military, corporations, financial institutions, hospitals, and private businesses as they amass a great deal of confidential information about their employees, customers, products, research and financial status. So far, security-modeling work has been largely independent of system requirements and product family modeling. It is a common practice to model system requirements first and then security is added as an afterthought. Usually the security part of a system is overlaid on the subsystem of the main functionality. It is the long-term objective of this research program to unify feature modeling and other early requirements models with confidentiality models to gain a unified view of the product family and its confidentiality requirements. The aim is to obtain models that can evolve with the changes in the software family environments, which would enable us generate and propagate the needed changes to the security prevention and detection mechanisms. Consequently, we systematically and quickly strengthen the responses of the products of a software family to emerging threats. The proposed research will take the following complementary research directions: 1) Investigate models that capture the domain and security knowledge in preventing indirect unauthorized information leakage through cover channel communication. This direction will involve a formal representation of an ontology that is suitable for an algebraic specification of software systems. 2) Expand our early-established results on product family to equip feature models with a representation of the context and the environment in which each feature of the family is expected to evolve. This context and each feature environment are captured by the domain and security ontology. 3) Explore dynamic instantiation of confidentiality policy and the mechanisms for enhancing information confidentiality. From a set of confidentiality rules given by the security risk management officers, a more thorough and complete set of rules are generated (calculated) taking into account the security knowledge and domain knowledge of the product family. The proposed research would enable us to have software systems that can on the fly update their confidentiality policy and mechanisms with each change in the environment. The security and software domain ontology will capture changes in the system's environment and then a new set of confidentiality rules will formally be calculated and included in the system. I aim at adopting an algebraic approach to formally model and unify security and product families models. The proposed methodology, due to its algebraic flavor, brings a calculational way to generate confidentiality rules and verification of the properties of the unified model. Moreover, it brings rigor in modeling and fosters a disciplined approach to software engineering to handle security aspects. The proposed calculational processes would be easily automated using computer algebra systems and theorem provers. The proposed research represents a rigorous approach to enhance information confidentially in an ever-changing world. The obtained results would bring major contributions to information security and affect research in other areas that use ontologies such as business intelligence and eHealth.