Aspect-Oriented Security Hardening of Design Models

点击翻译按钮获取中文摘要

Software security becomes increasingly important. Nevertheless, it is very often considered as an afterthought phase of the development life cycle. However, given the complexity and pervasiveness of modern software systems, addressing security later in the development process leads to huge cost in retrofitting security into the software and further can introduce additional vulnerabilities. Therefore, security must be considered early during the engineering process. To this end, a promising approach is to adopt the emerging Model Driven Architecture (MDA) paradigm and the prominent modeling languages, such as the Unified Modeling Language (UML) and the Systems Modeling Language (SysML), in order to address security throughout the development life cycle. Furthermore, security is a crosscutting concern that pervades the entire software. The manual addition of security features into design models, especially for large scale software, often leads to scattered security features tangled in the main functionality. Additionally, adding security manually is tedious and generally may lead to other security flaws. A promising approach is to consider Aspect-Oriented Modeling (AOM) as a mechanism for security specification and injection at the software design phase. In recent years, AOM has become the focus of many research initiatives. However, the majority of these proposals are presented from a practical perspective. In addition, very few proposals leveraged AOM to address security. As such, our proposal aims to elaborate a practical and a formal framework for the security hardening of design models. In particular, the targeted objectives are the following: (1) Design an algebra of pointcut/advice primitives to specify security concerns on design models, (2) devise an AOM security profile that leverages the aforementioned algebra, (3) elaborate semantic definitions for matching and weaving for the profile constructs, (4) derive, from the semantic definitions, matching and weaving algorithms that will be used to design and implement an environment for the specification and injection of security aspects within design models, (5) conduct real-life case studies to validate the importance, relevance and practicality of the proposed framework.