Options
Security in context: analysis and refinement of software architectures
Publikationstyp
Conference Paper
Date Issued
2010-07
Sprache
English
Author(s)
Start Page
161
End Page
170
Article Number
5676254
Citation
Proceedings - 34th International Computer Software and Applications Conference : 5676254, 161-170 (2010)
Contribution to Conference
Publisher DOI
Scopus ID
Publisher
IEEE
Security analysis methods can provide correct yet meaningless results if the assumptions underlying the model do not conform to reality. We present an approach to analyze the security of software-intensive system architectures that focusses on making these underlying assumptions explicit, so that they can be taken into account. Starting from an Alloy model of a software architecture, a set of constraints is elicited by leveraging model relaxation techniques. These constraints form a minimal but sufficient condition that the system must meet in order to realise its security requirements. As the approach starts from the minimal guarantees that the system environment offers, it does not depend on an explicit attacker model and can take arbitrary attacker behaviour into account. As it is iterative, it is possible to constructively integrate the approach in a secure software development life cycle. Our results are illustrated by means of a case study.
Subjects
Alloy
Analysis
Security
Software architecture
DDC Class
004: Informatik