Automatic Enforcement of Security Properties

Abstract

Ensuring the security requirements of an application is not a straightforward task. Security properties (e.g., confidentiality, anonymity) need to be satisfied in different ways in different parts of the same application. Software architects are usually required to manually define security components and their dependencies with the base application, customize them to the application's requirements, identify the points where security is incorporated, and verify that the selected places are correct. The last two steps are especially complex and errorprone. In our approach, we aim to provide a solution that helps software architects to identify the correct places to incorporate the security functionality and to verify the correctness of the composed application architecture. This is achieved by identifying a set of general structural patterns for incorporating security into the application architecture, and by providing a model-driven SPL solution to customize these patterns to each application's requirements.

Empirical analysis of the tool support for software product lines

“…Finding the right combination of algorithms and correct settings to use is often difficult [3]. Cryptography is also required by almost all electronic-based systems, such as e-payment systems and e-voting applications [65,74]. The encryption components need to be specifically customized to the application's requirements (e.g., the RSA algorithm with keys of 2048 bits) and then introduced (weaving) in the software architec-ture of the applications in a non-intrusive way (e.g., using an aspect-oriented approach).…”