Towards Security-Explicit Formal Modelling of Safety-Critical Systems

Troubitsynå, Elena; Laibinis, Linas; Pereverzeva, Inna; Kuismin, Tuomas; Ilić, Dubravka; Latvala, Timo

doi:10.1007/978-3-319-45477-1_17

Cited by 18 publications

(11 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…STPA‐SafeSec 120 is an analysis methodology for both safety and security. The use of STAMP is mentioned in Troubitsyna et al 33 The use of STPA is mentioned in previous studies 52,58,60 . The use of STPA‐Sec is mentioned in previous studies 110,111,116,117,133 .…”

Section: Mapping Study Resultsmentioning

confidence: 99%

“…As anticipated, most of the studies (51 out of 143) were focusing on the level of requirements. Fifteen studies 23–37 out of those 51 were focusing exclusively on requirements modeling of such systems. Thirty‐one studies 38–68 were focusing on both requirements modeling and analysis.…”

Section: Mapping Study Resultsmentioning

confidence: 99%

“…Twenty-three F I G U R E 4 RQ3: Studies classification based on contributions studies were applied to control systems. Control systems included general-purpose control systems, 39,56,62,110,124,143 air traffic control systems, 24,44,73,102 access control systems, 29,54 industrial control systems, 30,33,53,80,113,144 network control systems, 56 electrical substation automation systems, 85 and building automation systems. 25,27 After control systems, avionic/aviation systems were most attractive for researchers of this topic.…”

Section: Evaluation Domains (Rq4)mentioning

confidence: 99%

“…Security (SAFECOMP). Twenty-seven studies 24,33,47,48,[50][51][52]56,68,81,84,[88][89][90]92,93,99,101,103,[115][116][117]119,138,141,151,157 are published on this venue.…”

Section: Publication Types (Rq5a)mentioning

confidence: 99%

See 3 more Smart Citations

Model‐driven engineering of safety and security software systems: A systematic mapping study and future research directions

Mashkoor

Egyed

Wille

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

This article presents a systematic mapping study on the model-driven engineering of safety and security concerns in software systems. Combined modeling and development of both safety and security concerns is an emerging field of research as both concerns affect one another in unique ways. Our mapping study provides an overview of the current state of the art in this field. This study carefully selected 143 publications out of 27,259 relevant papers through a rigorous and systematic process. This study then proposes and answers questions such as frequently used methods and tools and development stages where these concerns are typically investigated in application domains. Additionally, we identify the community's preference for publication venues and trends. The discussion on obtained results also features the gained insights and future research directions.

show abstract

Section: Mapping Study Resultsmentioning

confidence: 99%

Section: Mapping Study Resultsmentioning

confidence: 99%

Section: Evaluation Domains (Rq4)mentioning

confidence: 99%

“…Security (SAFECOMP). Twenty-seven studies 24,33,47,48,[50][51][52]56,68,81,84,[88][89][90]92,93,99,101,103,[115][116][117]119,138,141,151,157 are published on this venue.…”

Section: Publication Types (Rq5a)mentioning

confidence: 99%

See 2 more Smart Citations

Model‐driven engineering of safety and security software systems: A systematic mapping study and future research directions

Mashkoor

Egyed

Wille

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

show abstract

“…In our previous work [27], [26], we have investigated the problem of deriving the security requirements from the formal system model. The approach presented in this paper, complements this work by bridging the gap between the security requirements and the actual code.…”

Section: Related Workmentioning

confidence: 99%

Securing Open Source Clouds Using Models

Rauf

Troubitsynå

2018

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

The widespread adoption of cloud computing has resulted in proliferation of open source cloud computing frameworks that give more control to enterprises over their data and networks. Though, the benefits of the open source software are widely recognized, there is a growing concern over their security assurance. Often open source software is a subject of frequent updates. The updates might introduce or remove a variety of features and hence violate security properties of the previous releases. Obviously, a manual inspection of security would be prohibitively slow and inefficient. In this work, we propose an automated approach that can help developers to assure security of open source cloud framework even in the presence of frequent releases. Our methodology consists of creating a (stateful) wrapper that emulates the usage scenarios with explicit representation of security and functional requirements as contracts. We use a model-driven approach to model REST APIs of KeyStone, an identity service in OpenStack. Openstack is an open source cloud computing framework providing IaaS. Our models define structural and behavioral properties of Keystone together with its security requirements. We detail the implementation of these models in Django Web Framework and also show how to use the behavioral interfaces to implement a service monitor for the cloud services. This mechanism facilitates verification and validation of functional behavior and security requirement in an automated manner. Keystone Open StackKeystone is the centralized identity service of OpenStack that offers authentication and authorization [25]. KeyStone authenticates a user by generating a token. A token can either be scoped or unscoped depending on the client's request and the configured policy of KeyStone. An unscoped token authenticates a user without authorising for any project. In contrast, a scoped token provides the authorization information of the user for a particular project or domain.KeyStone offers REST API in compliance with OpenStack policy [3]. REST services expose their functionality as resources and each resource has a unique URI that provides addressability. CRUD (create, retrieve, update and delete) operations can be performed on resources using standard HTTP methods. This means that only HTTP request methods (GET, PUT, POST, DELETE) can be invoked on KeyStone resources. In order to offer scalability, the statelessness feature of REST is ensured by treating every request independently without requiring any session or cookie information from user requests. Each resource, when invoked via its URI and a standard HTTP method, replies with a status code and a resource representation, which contains the data about the resource attributes and links to other resources. The HTTP response code is a numeric code that tells the clients whether the request went successfully. HTTP has a list of status codes that reveal how the request went [7], for example, 200 means the request was successful, 404 means the resource was not found and 403 implies th...

show abstract

Modelling and Verification of Dynamic Role-Based Access Control

Vistbakka

Troubitsynå

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Towards Security-Explicit Formal Modelling of Safety-Critical Systems

Cited by 18 publications

References 8 publications

Model‐driven engineering of safety and security software systems: A systematic mapping study and future research directions

Model‐driven engineering of safety and security software systems: A systematic mapping study and future research directions

Securing Open Source Clouds Using Models

Modelling and Verification of Dynamic Role-Based Access Control

Contact Info

Product

Resources

About