Formalization of Web Security Patterns

Abstract

Abstract. Security issues in software industries become more and more challenging due to malicious attacks and as a result, it leads to exploration of various security holes in software system. In order to secure the information assets associated with any software system, organizations plan to design the system based on a number of security patterns, useful to build and test new security mechanisms. These patterns are nothing but certain design guidelines. But they have certain limitations in terms of consistency and usability. Hence, these security patterns may sometimes act as insecure. In this study, an attempt has been made to compose security patterns for the web-based application. Subsequently, a formal modeling approach for the composition of security patterns is presented. In order to maximize comprehensibility, Unified Modeling Language (UML) notations are used to represent structural and behavioral aspects of a web-based system. A formal modeling language i.e., Alloy has been taken into consideration for analyzing web-based security pattens. For the demonstration of this approach, a case study i.e., an online banking system is considered. A qualitative evaluation is performed for the identified security patterns against the critical security properties. In this study a model-driven framework is presented, which helps to automate the process of analyzing web security patterns.

An Approach for Verification of Secure Access Control Using Security Pattern

“…Alzahrani [18] demonstrated the use of codecharts for formal specification and verification of security patterns in terms of generalisation and abstraction. Dwivedi and Rath [19,20] presented verification of five security patterns of web applications and one security pattern of Service-Oriented Architecture (SOA) using Alloy [21]. The security patterns verified by Dwivedi and Rath [19,20] are secure proxy, single-sign-on, check point, authenticator, and access policy.…”

“…Dwivedi and Rath [19,20] presented verification of five security patterns of web applications and one security pattern of Service-Oriented Architecture (SOA) using Alloy [21]. The security patterns verified by Dwivedi and Rath [19,20] are secure proxy, single-sign-on, check point, authenticator, and access policy.…”

Pattern-Based Approach to Modelling and Verifying System Security

“…• transforming UML models of security patterns to Alloy [15] and using the Alloy Analyzer to check the incon-sistencies and ambiguities within security patterns [10]. Five security patterns were studied.…”

Modeling and Analyzing Security Patterns Using High Level Petri Nets

“…Furthermore, no detailed model checking result was given. In [5], a formal modeling approach for composing security patterns for web-based applications was proposed. This approach uses UML to model the security patterns and their composition and then transforms the UML model to Alloy (a formal specification language based on first order logic) formal specification for security property analysis.…”