Security Compliance in Model-driven Development of Software Systems in Presence of Long-Term Evolution and Variants

Description

For ensuring a software system's security, it is vital to keep up with changing security precautions, attacks, and mitigations. Although model-based development enables addressing security already at design-time, design models are often inconsistent with the implementation or among themselves. An additional burden are variants of software systems. To ensure security in this context, we present an approach based on continuous automated change propagation, allowing security experts to specify security requirements on the most suitable system representation. We automatically check all system representations against these requirements and provide security-preserving refactorings for preserving security compliance. For both, we show the application to variant-rich software systems. To support legacy systems, we allow to reverse-engineer variability-aware UML models and semi-automatically map existing design models to the implementation. Besides evaluations of the individual contributions, we demonstrate the approach in two open-source case studies, the iTrust electronics health records system and the Eclipse Secure Storage. Acknowledgements Abstract Zusammenfassung Contents Abbreviations List of Figures List of Tables Listings Part I Opening Chapters 1 Introduction 1.1 Problem Identification 1.2 Outline of the Approach 1.3 Research Questions 1.4 Research Methodology 1.5 Outline 2 Running Example: iTrust 2.1 Development of a Medical Management System 2.2 The iTrust Electronics Health Records System 2.3 Suitability of iTrust Concerning the Research Questions 3 State of the Art in Secure Software Systems Development 3.1 Object-Oriented Programming 3.2 Restructuring and Adaption 3.3 Model-driven Software Development 3.3.1 Domain Model 3.3.2 Design Model 3.3.3 Implementation Model 3.4 Development Processes 3.4.1 Sequential Software Development 3.4.2 Agile Software Development 3.5 (Security-)Compliance & Certifications 3.5.1 Architecture Compliance Checking 3.5.2 Software Reviews and Audits 3.5.3 Standards and Certifications 3.6 Security Checks 3.6.1 UMLsec Security Checks 3.6.2 SecDFD Security Checks 3.6.3 Implementation-Level Security Checks 3.7 Conclusion on the State of the Art 4 A Walkthrough of the Proposed Development Approach 4.1 Key Ideas of the GRaViTY Approach 4.2 The GRaViTY Development Approach 4.3 Developer Perspective on Using GRaViTY Part II Tracing 5 Program Model for Object-oriented Languages 5.1 Background on Program Representations 5.2 Program Model for Object-oriented Programs 5.2.1 Namespaces 5.2.2 Types 5.2.3 Inheritance 5.2.4 Methods & Fields 5.2.5 Member Access 5.2.6 Overloading, Overwriting and Hiding 5.2.7 Modifiers & Visibilities 5.2.8 Annotation Mechanism 5.3 Tool Support 5.4 Evaluation of the Program Model 5.5 Threats to Validity 5.6 Conclusion on the proposed Program Representation 6 Model-Synchronization and Tracing 6.1 Background on Tracing 6.2 Inter-Artifact Tracing and Model-Synchronization 6.2.1 Background on Bidirectional Graph Transformations 6.2.2 Model-Synchronization with Triple Graph Grammars 6.2.3 Tool Support for the Model Synchronization 6.2.4 Evaluation of the Model Synchronization 6.2.5 Threats to Validity 6.2.6 Conclusion on the Inter Artifact Model-Synchronization 6.3 Tracing within UML Models of Different Abstraction 6.3.1 Background on Refinements in UML Models 6.3.2 Refinement Relationship Types 6.3.3 Polymorphism in UML 6.3.4 UMLsec Secure Dependency in the Context of Inheritance 6.3.5 Refinements of UML Models 6.3.6 Tool Support for Model Refinements 6.3.7 Conclusion on Tracing within UML Models 6.4 Tracing and Propagation of Security Requirements 6.4.1 Persistence of Security Requirements in the Implementation 6.4.2 Dynamic Tracing between UML Models and the Implementation 6.4.3 Conclusion on the Propagation of Security Requirements 7 Application to Legacy Projects using Reverse-Engineering 7.1 Reverse-Engineering UML Models Using TGGs 7.2 Mapping Early Design-Models to Code 7.2.1 Background on Early Design Models 7.2.2 Semi-Automated Mapping Approach 7.2.3 Tool Support for Semi-Automated Mappings 7.2.4 Evaluation 7.2.5 Threats to Validity 7.2.6 Conclusion on the Semi-Automated Mappings 7.3 Conclusion on the Application to Legacy Projects Part III Security 8 Static Security Compliance Checks 8.1 Background on Static Security Analysis 8.1.1 Design Model-based Security Checks 8.1.2 Static Code Analysis 8.2 Structural Compliance between Models and Code 8.2.1 Automation of Structural Compliance Checks 8.2.2 Tool Support for Structural Compliance Checks 8.2.3 Conclusion on the Structural Compliance Checks 8.3 Leveraging Correspondence Models for the Calculation of Security Metrics 8.3.1 Background on Security Metrics 8.3.2 Leveraging Traces for Security Metric Calculation 8.3.3 Tool Support for the Calculation of Security Metrics 8.3.4 Conclusion on Security Metrics 8.4 Security Compliance Checks between Models & Code 8.4.1 Verification of SecDFD Contracts 8.4.2 Tool Support for the Verification of Contract Implementations 8.4.3 Evaluation of the Contract Verification 8.4.4 Threats to Validity 8.4.5 Conclusion on the SecDFD Contract Verification 8.5 Optimized Data Flow Analysis 8.5.1 Optimizing Data Flow Analysis based on Security Requirements 8.5.2 Tool Support for Optimized Data Flow Analysis 8.5.3 Evaluation of the Optimized Data Flow Analysis 8.5.4 Threats to Validity 8.5.5 Conclusion on the Optimized Data Flow Analysis 8.6 Specification of Incremental Security Checks 8.6.1 Background on Henshin Model Transformations 8.6.2 Incremental Security Violation Patterns 8.6.3 Tool Support for Security Violation Patterns 8.6.4 Evaluation of Incremental Security Violation Patterns 8.6.5 Threats to Validity 8.6.6 Conclusion on Security Violation Patterns 9 Verification and Enforcement of Security at Run-time 9.1 Background on Security Compliance at Run-time 9.2 Example Security Violation 9.3 Verification at Run-time and Model Adoption 9.3.1 Security Monitoring at Run-time 9.3.2 Countermeasures 9.3.3 Automated Software System Evolution 9.4 Tool Support for Monitoring and Adaption 9.4.1 Java Annotations and IDE Support 9.4.2 Validation at Run-time and Countermeasures 9.4.3 Automated Adaption of Design-Time Models 9.5 Evaluation of the Security Monitor 9.5.1 O1–Effectiveness of the Run-time Monitoring 9.5.2 O2–Applicability of the Run-time Monitoring 9.5.3 O3–Usability 9.6 Threats to Validity 9.6.1 Internal Validity 9.6.2 External Validity 9.7 Conclusion on the Run-time Security Monitoring Part IV Maintenance 10 Security-aware Refactoring of Software Systems 10.1 Background on Object-Oriented Refactorings 10.2 Formalization of Object-Oriented Refactorings 10.2.1 Refactoring of Java Programs 10.2.2 Program Refactoring based on Graph Transformation 10.2.3 Co-Evolution due to Refactoring Application 10.2.4 Tool Support for the Application of Formalized Refactorings 10.2.5 Evaluation of the Refactoring Technique 10.2.6 Threats to Validity 10.2.7 Conclusion on Formalizing Refactorings 10.3 Security-aware Refactorings 10.3.1 Controlling the Attack Surface of Object-Oriented Refactorings 10.3.2 Security Preserving Refactorings 10.3.3 Conclusion on the Security Preserving Refactorings 10.4 Conclusion on the Refactoring of Security-Critical Software Systems Part V Variants 11 Specification of Variability throughout Variant-rich Software Systems 11.1 Background on Variability Engineering 11.1.1 Feature Identification and Specification 11.1.2 Implementation of Variability 11.1.3 Product Deployment 11.2 UML and PM Variability Extension 11.2.1 Variability Notations in GRaViTY 11.2.2 Parsing of Antenna Annotations and Mapping to Models 11.3 Tool Support for the Synchronization of Variability Annotations 11.4 Evaluation of the Variability Extension 11.5 Threats to Validity 11.5.1 Construct Validity 11.5.2 Internal Validity 11.5.3 External Validity 11.6 Conclusion on GRaViTY's Variability Extension 12 Security in UML Product Lines 12.1 Security and Variability Profile 12.1.1 «ConditionalCritical» 12.1.2 «ConditionalSecrecy», «ConditionalIntegrity», etc. 12.1.3 «ConditionalEncrypted», «ConditionalLAN», etc. 12.2 Deriving Products 12.3 Family-based Security Analysis 12.3.1 UMLsec Checks as OCL Constraints 12.3.2 Template Interpretation 12.3.3 Discussion of Correctness and Performance 12.3.4 Extensibility of the Approach 12.4 Tool Support for Family-based Security Checks of UML Product Lines 12.5 Evaluation of SecPL 12.5.1 O1–Efficiency of the Security Checks 12.5.2 O3–Usefulness of the Tool Support and Security Checks 12.6 Threats to Validity 12.6.1 External Validity 12.6.2 Internal Validity 12.6.3 Conclusion Validity 12.6.4 Construct Validity 12.7 Conclusion on Security in UML Product Lines 13 Security Compliance and Restructuring in Variant-rich Software Systems 13.1 Application Scenario 13.1.1 iTrust example SPL 13.1.2 Rule Variants 13.1.3 Variability-based Model Transformation 13.2 Multi-Variant Model Transformation 13.2.1 Solution Overview 13.2.2 Multi-Variant Transformation Algorithm 13.3 Tool Support for Multi-Variant Model Transformation 13.4 Evaluation of the Multi-Variant Model Transformation 13.4.1 Detection of Edit Operations 13.4.2 Move Method Refactorings 13.5 Threats to Validity 13.5.1 External Validity 13.5.2 Construct Validity 13.6 Conclusion on Multi-Variant Model Transformation Part VI Tool Support and Application 14 The GRaViTY Framework 14.1 Structuring into Eclipse Plugins 14.2 GRaViTY as Software Product Line 14.3 Conclusion on the Implementation of GRaViTY 15 Case Studies 15.1 Case Study 1: iTrust 15.1.1 Description of the Case Study Execution 15.1.2 Discussion of the Observations 15.2 Case Study 2: Eclipse Secure Storage 15.2.1 Discussion of the Case Study Execution 15.2.2 Discussion of the Observations 15.3 Threats to Validity 15.4 Conclusion on the Case Studies Part VII Closing Chapters 16 Related Work 16.1 Tracing between Models and Code 16.2 Security Compliance of Models and Code 16.2.1 Model-Based Security Analysis 16.2.2 Security Compliance 16.2.3 Run-time Security Monitoring 16.3 (Security-aware) Refactorings 16.4 Software Product Lines 16.4.1 Product Line Transformations 16.4.2 Security of Software Product Lines 17 Conclusion 17.1 Research Outcomes 17.2 Assumptions and Limitations 17.2.1 Required Artifacts 17.2.2 Tracing and Synchronization 17.2.3 Security Requirements and Checks 17.2.4 Security Preservation and Re-Certification 17.2.5 Software Product Lines 17.3 Outlook 17.3.1 Automated Trace Creation 17.3.2 Continuous Integration 17.3.3 Multi-Language Software Systems 17.3.4 Security Requirements and Checks 17.3.5 Customization 17.3.6 Expressiveness of Languages 17.3.7 Distributed System Analysis 17.3.8 Code Generation 17.3.9 Software Product Lines 17.4 Summary A Bibliography