Run-Time Security Traceability for Evolving Systems

Abstract

Security-critical systems are challenging to design and implement correctly and securely. A lot of vulnerabilities have been found in current software systems both at the specification and the implementation levels. This paper presents a comprehensive approach for model-based security assurance. Initially, it allows one to formally verify the design models against high-level security requirements such as secrecy and authentication on the specification level, and helps to ensure that their implementation adheres to these properties, if they express a system's run-time behaviour. As such, it provides a traceability link from the design model to its implementation by which the actual system can then be verified against the model while it executes. This part of our approach relies on a technique also known as run-time verification. The extra effort for it is small as most of the computation is automated; however, additional resources at run-time may be required. If during run-time verification a security weakness is uncovered, it can be removed using aspectoriented security hardening transformations. Therefore, this approach also supports the evolution of software since the traceability mapping is updated when refactoring operations are regressively performed using our tool-supported refactoring technique. The proposed method has been applied to the Java-based implementation JESSIE of the Internet security protocol SSL, in which a security weakness was detected and fixed using our approach. We also explain how the traceability link can be transformed to the official implementation of the Java Secure Sockets Extension (JSSE) that was recently made open source by Sun.

Specification, verification, and quantification of security in model-based systems

“…Bauer et al [69] propose an approach for model-based security assurance that supports security verification at both levels: design and implementation. At the specification level, the design models are verified formally against high-level security requirements such as secrecy and authentication.…”

Formal verification of security protocol implementations: a survey

“…Accordingly, this survey is oriented towards symbolic models, and just mentions the first attempts made in the direction of computational models [BCFZ08,BMU10,FKS11,KTG12]. There is still another approach that has been investigated by some researchers as a means for ensuring or verifying the correspondence between an abstract security protocol model and its implementation: runtime verification [Jür05,JYB08,PJ10,BJ10,BJY11]. According to this approach, the protocol model is formal and proved correct.…”