Towards a library of composable models to estimate the performance of security solutions

Abstract

Complex distributed dependable systems, such as web-based applications that contain sensitive data and are exposed to many users, have to meet different, and sometimes conflicting, non functional requirements, such as security and performance requirements. A typical example of this trade-off is the performance degradation introduced in a system by the raising of security solutions. Several proposals have been made to estimate the performance of security methodologies, but they are often grounded to existing standards such as IPsec and SSL. In this paper we tackle the problem from a model-based viewpoint: we introduce basic performance models for security mechanisms, which can be considered as building bricks to compose in order to model security services. To this goal, we introduce rules that drive the composition. Security service models can then be integrated with functional models of critical applications to estimate the performance of the adopted security solutions. We represent models as Generalized Stochastic Petri Nets (GSPNs). This is a first step towards a Security Library containing composable performance models of security mechanisms and services and representing an instrument to support designers in decisions related to the security vs performance trade-off. We show how to use our models on an example of banking system.

Introducing Software Performance Antipatterns in Cloud Computing Environments

“…In the cloud computing context we started focusing on performance and security that are related by a trade-off relationship, hence we aim to quantify the performance degradation incurred to achieve certain security requirements. From our previous work [5,19] we experimented that the values of indices coming from the solution of the performance model (i.e. the one that includes security aspects) can be compared to the ones obtained for the same model (i) without security solutions, (ii) with different security mechanisms and (iii) with different implementations of the same security mechanism.…”

Towards a methodology driven by relationships of quality attributes for qos-based analysis

“…The critical aspect that we found between performance and security is the need to quantify the performance degradation incurred to achieve the security requirements. From our previous work [8,9,17] we experimented that the solution of a performance model that embeds security aspects allows to quantify the trade-off between security and performance in software architectures. In particular, the values of indices coming from the solution of the performance model (i.e.…”

Optimising multiple quality criteria of service-oriented software architectures

“…Cortellessa and Trubiani [8] present an approach to study the trade-off between performance and different security levels based on Generalized Stochastic Petri Nets. Bondarev et al [6] present a framework to evaluate performance and cost for a given set of candidates and supports trade-off analysis with Pareto-curve visualisation.…”