SysML Models and Model Transformation for Security

Lugou, Florian; Li, Letitia W.; Apvrille, Ludovic; Ameur-Boulifa, Rabéa

doi:10.5220/0005748703310338

Cited by 18 publications

(9 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to achieve this, we rely on the prevalent system modeling language SysML. As a matter of fact, several studies use SysML as their basis for security risk assessment [20], secure system design [21] for model transformations [22]. We share the same system engineering vision for security management as these studies to address a different aspect of security that is operational management.…”

Section: Related Work and Problematicmentioning

confidence: 99%

An Operational Responsibility and Task Monitoring Method: A Data Breach Case Study

Assoul¹,

Rabii²,

Roudiès³

2021

Adv. sci. technol. eng. syst. j.

View full text Add to dashboard Cite

As a result of digitalization, services become highly dependent on information systems thus increasing the criticality of security management. However, with system complexity and the involvement of more human resources, it becomes more arduous to monitor and track tasks and responsibilities. This creates a lack of visibility hindering decision making. To support operational monitoring, we propose a method composed of i) a core of security concepts from International Standard Organization (ISO) standards ii) a graphical modeling language iii) a guiding process and iv) a tool that provides verification through formal Object Constraint Language (OCL) queries. Applying this method to the case of the Capital One data breach showcases incident prevention through task supervision. The resulting work product is a formal comprehensive map of assets, actors, tasks and responsibilities. The SysML formalism allows different actors to extract information from the map using OCL queries. This allows for regular task and responsibility verification thus closing any window of attack possible.

show abstract

Section: Related Work and Problematicmentioning

confidence: 99%

An Operational Responsibility and Task Monitoring Method: A Data Breach Case Study

Assoul¹,

Rabii²,

Roudiès³

2021

Adv. sci. technol. eng. syst. j.

View full text Add to dashboard Cite

show abstract

“…However, it does not provide formal verification support. Another approach [36,37] uses SysML to model the security aspects of systems and ProVerif is used to verify security properties: this approach is omitted from the comparison due to the lack of generality.…”

Section: Related Workmentioning

confidence: 99%

Mixed-semantics composition of statecharts for the component-based design of reactive systems

et al. 2020

View full text Add to dashboard Cite

The increasing complexity of reactive systems can be mitigated with the use of components and composition languages in model-driven engineering. Designing composition languages is a challenge itself as both practical applicability (support for different composition approaches in various application domains), and precise formal semantics (support for verification and code generation) have to be taken into account. In our Gamma Statechart Composition Framework, we designed and implemented a composition language for the synchronous, cascade synchronous and asynchronous composition of statechart-based reactive components. We formalized the semantics of this composition language that provides the basis for generating composition-related Java source code as well as mapping the composite system to a back-end model checker for formal verification and model-based test case generation. In this paper, we present the composition language with its formal semantics, putting special emphasis on design decisions related to the language and their effects on verifiability and applicability. Furthermore, we demonstrate the design and verification functionality of the composition framework by presenting case studies from the cyber-physical system domain.

show abstract

“…The concerned data channels are annotated with green locks in figure 10. In TTool, channels can be either private or public and only attacks on public channels are considered [23].…”

Section: System Verificationmentioning

confidence: 99%

SysML models

Zoor

Apvrille

Pacalet

2020

Proceedings of the 23rd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems: Companion Proceedi

Self Cite

View full text Add to dashboard Cite

Designing safe, secure and efficient embedded systems implies understanding interdependencies between safety, security and performance requirements and mechanisms. In this paper, we introduce a new technique for analyzing the performance impact of safety/security implemented as hardware and software mechanisms and described in SysML models. Our analysis approach extracts a dependency graph from a SysML model. The SysML model is then simulated to obtain a list of simulation transactions. Then, to study the latency between two events of interest, we progressively taint the dependency graph according to simulation transactions and to dependencies between all software and hardware components. The simulation transactions are finally classified according to which vertex taint they correspond, and are displayed according to their timing and related hardware device. Thus a designer can easily spot which components need to be re-modeled in order to meet the performance requirement. A Rail Carriage use case studied in the scope of the H2020 AQUAS project illustrates our approach, in particular how tainting can handle the multiple occurrences of the same event. CCS CONCEPTS • Computer systems organization → Embedded software.

show abstract

SysML Models and Model Transformation for Security

Cited by 18 publications

References 11 publications

An Operational Responsibility and Task Monitoring Method: A Data Breach Case Study

An Operational Responsibility and Task Monitoring Method: A Data Breach Case Study

Mixed-semantics composition of statecharts for the component-based design of reactive systems

SysML models

Contact Info

Product

Resources

About