A Framework for Composable Security Definition, Assurance, and Enforcement

Abstract

Abstract. The objective of this research is to develop techniques that integrate alternative security concerns (e.g., mandatory access control, delegation, authentication, etc.) into the software process. The resulting model-driven framework preserves separation of security concerns from modeling through implementation, and allows security personnel to pick and choose security concerns to concerns promotes security assurance, and should result in a reduction of the security defects in the final system. To achieve separation of concerns at the modeling level, concern-specific languages are defined to capture alternative security concerns. At the implementation level, aspectoriented programming is used to integrate security concerns into an application's code, while preserving modularity. This composition seamlessly combines the chosen security concerns to realize an application's security infrastructure.

Building Assured Systems Framework

“…The author says, "My doctoral research proposes a composable security definition, assurance, and enforcement via a model-driven framework that preserves separation of security concerns from modeling through implementation, and provides mechanisms to compose these concerns into the application while maintaining consistency between design models and code" [Pavlich-Mariscal 2006].This is clearly a development framework, rather than a research framework. …”