A Formal Approach to Identifying Security Vulnerabilities in Telecommunication Networks

Laibinis, Linas; Troubitsynå, Elena; Pereverzeva, Inna; Oliver, Ian; Holtmanns, Silke

doi:10.1007/978-3-319-47846-3_10

Cited by 3 publications

(1 citation statement)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The approach presented in this paper, complements this work by bridging the gap between the security requirements and the actual code. In [16], we have proposed a method for identifying security vulnerabilities using formal architectural model. The UML modeling patterns proposed in this paper can significantly facilitate constructing such models and hence, enable the industrial adoption of the proposed technique.…”

Section: Related Workmentioning

confidence: 99%

Securing Open Source Clouds Using Models

Rauf

Troubitsynå

2018

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

The widespread adoption of cloud computing has resulted in proliferation of open source cloud computing frameworks that give more control to enterprises over their data and networks. Though, the benefits of the open source software are widely recognized, there is a growing concern over their security assurance. Often open source software is a subject of frequent updates. The updates might introduce or remove a variety of features and hence violate security properties of the previous releases. Obviously, a manual inspection of security would be prohibitively slow and inefficient. In this work, we propose an automated approach that can help developers to assure security of open source cloud framework even in the presence of frequent releases. Our methodology consists of creating a (stateful) wrapper that emulates the usage scenarios with explicit representation of security and functional requirements as contracts. We use a model-driven approach to model REST APIs of KeyStone, an identity service in OpenStack. Openstack is an open source cloud computing framework providing IaaS. Our models define structural and behavioral properties of Keystone together with its security requirements. We detail the implementation of these models in Django Web Framework and also show how to use the behavioral interfaces to implement a service monitor for the cloud services. This mechanism facilitates verification and validation of functional behavior and security requirement in an automated manner. Keystone Open StackKeystone is the centralized identity service of OpenStack that offers authentication and authorization [25]. KeyStone authenticates a user by generating a token. A token can either be scoped or unscoped depending on the client's request and the configured policy of KeyStone. An unscoped token authenticates a user without authorising for any project. In contrast, a scoped token provides the authorization information of the user for a particular project or domain.KeyStone offers REST API in compliance with OpenStack policy [3]. REST services expose their functionality as resources and each resource has a unique URI that provides addressability. CRUD (create, retrieve, update and delete) operations can be performed on resources using standard HTTP methods. This means that only HTTP request methods (GET, PUT, POST, DELETE) can be invoked on KeyStone resources. In order to offer scalability, the statelessness feature of REST is ensured by treating every request independently without requiring any session or cookie information from user requests. Each resource, when invoked via its URI and a standard HTTP method, replies with a status code and a resource representation, which contains the data about the resource attributes and links to other resources. The HTTP response code is a numeric code that tells the clients whether the request went successfully. HTTP has a list of status codes that reveal how the request went [7], for example, 200 means the request was successful, 404 means the resource was not found and 403 implies th...

show abstract

Section: Related Workmentioning

confidence: 99%

Securing Open Source Clouds Using Models

Rauf

Troubitsynå

2018

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

show abstract

5G Slicing as a Tool to Test User Equipment Against Advanced Persistent Threats

Isotalo

2017

Network and System Security

View full text Add to dashboard Cite

Event-B Hybridation

Dupont

Aït‐Ameur

Singh

et al. 2021

ACM Trans. Embed. Comput. Syst.

View full text Add to dashboard Cite

Hybrid systems are complex systems where a software controller interacts with a physical environment, usually named a plant, through sensors and actuators. The specification and design of such systems usually rely on the description of both continuous and discrete behaviours. From complex embedded systems to autonomous vehicles, these systems became quite common, including in safety critical domains. However, their formal verification and validation as a whole is still a challenge. To address this challenge, this article contributes to the definition of a reusable and tool supported formal framework handling the design and verification of hybrid system models that integrate both discrete (the controller part) and continuous (the plant part) behaviours. This framework includes the development of a process for defining a class of basic theories and developing domain theories and then the use of these theories to develop a generic model and system-specific models. To realise this framework, we present a formal proof tool chain, based on the Event-B correct-by-construction method and its integrated development environment Rodin, to develop a set of theories, a generic model, proof processes, and the required properties for designing hybrid systems in Event-B. Our approach relies on hybrid automata as basic models for such systems. Discrete and continuous variables model system states and behaviours are given using discrete state changes and continuous evolution following a differential equation. The proposed approach is based on refinement and proof using the Event-B method and the Rodin toolset. Two case studies borrowed from the literature are used to illustrate our approach. An assessment of the proposed approach is provided for evaluating its extensibility, effectiveness, scalability, and usability.

show abstract

A Formal Approach to Identifying Security Vulnerabilities in Telecommunication Networks

Cited by 3 publications

References 10 publications

Securing Open Source Clouds Using Models

Securing Open Source Clouds Using Models

5G Slicing as a Tool to Test User Equipment Against Advanced Persistent Threats

Event-B Hybridation

Contact Info

Product

Resources

About