Designing Security-enhanced Embedded Systems: Bridging Two Islands of Expertise

Abstract

The increasing prevalence of embedded devices and a boost in sophisticated attacks against them make embedded system security an intricate and pressing issue. New approaches to support the development of security-enhanced systems need to be explored. We realise that efficient transfer of knowledge from security experts to embedded system engineers is vitally important, but hardly achievable in current practice. This thesis proposes a Security-Enhanced Embedded system Design (SEED) approach, which is a set of concepts, methods, and tools that together aim at addressing this challenge of bridging the gap between the two areas of expertise.First, we introduce the concept of a Domain-Specific Security Model (DSSM) as a suitable abstraction to capture the knowledge of security experts in a way that this knowledge can be later reused by embedded system engineers. Each DSSM characterises common security issues of a specific application domain in a form of security properties, which are further linked to a range of solutions.As a next step, we complement a DSSM with the concept of a Performance Evaluation Record (PER) to account for the resource-constrained nature of embedded systems. Each PER characterises the resource overhead created by a security solution, a provided level of security, and the evaluation technique applied.Finally, we define a process that assists an embedded system engineer in selecting a relevant set of security solutions. The process couples together (i) the use of the security knowledge accumulated in DSSMs and PERs, (ii) the identification of security issues in a system design, and (iii) the analysis of resource constraints of a system and available security solutions. The approach is supported by a set of tools that automate its certain steps.We use a case study from a smart metering domain to demonstrate how the SEED approach can be applied. We show that our approach adequately supports security experts in description of knowledge about security solutions in the form of formalised ontologies and embedded system engineers in integration of an appropriate set of security solutions based on that knowledge.

Evaluation of Visual Notations as a Basis for ICS Security Design Decisions

“…A similar approach is followed by Vasilevskaya, who also proposes to model security enhancements into UML diagrams, but mainly uses UML activity diagrams for visualization [41]. Since the scope is embedded systems, the diagrams model the internal behavior of suchlike systems very specifically.…”

Traceable Security-by-Design Decisions for Cyber-Physical Systems (CPSs) by Means of Function-Based Diagrams and Security Libraries

“…Goal-driven security decision making treats security just as functional aspects, where design goals are defined, often taking different stakeholders' perspectives, and then refined into requirements. It has been pursued to integrate security into software requirements engineering [29][30][31][32][33] and model-based systems engineering [34,35], but not for CPSs. This is probably due to the fact that goal-based engineering is popular in software engineering (so it seemed natural to extend the same principles to software security engineering), but largely unknown in CPS or ICS engineering.…”

Hcapp-Sec

“…Mas, nem sempre isso é possível. A verificação de requisitos de segurança precisa ser feita pela sistematização de avaliações de segurança de software, com projetos especificamente elaborados para o contexto de segurança da informação (Chikh, Abulaish, Nabi, & Alghathbar, 2011;Daramola, Sindre, & Stalhane, 2012;Elahi, 2009;Massacci, Mylopoulos, Paci, Yu, & Tun, 2011;Mellado, Blanco, Sánchez, & Fernández-Medina, 2010;Mellado et al, 2007;Salini & Kanmani, 2012, 2013Souag, tornam ainda mais sujeitos a ataques, pois todas as classes de atacantes podem explorar a falha para obtenção de vantagem indevida.…”

“…Definir os requisitos de segurança é um passo importante no processo de desenvolvimento. Um método para análise de requisitos com base em Security Targets Vasilevskaya (2013), com base em uma ontologia, propõe um método chamado Asset Elicitation Technique, que analisa o projeto do sistema para obter requisitos de segurança. Uma ontologia de avaliação (top-level) foi desenvolvida para capturar os resultados da avaliação de desempenho.…”