Abstract
Pattern-based development of software systems has gained more attention recently by addressing new challenges such as security and dependability. However, there are still gaps in existing modeling languages and/or formalisms dedicated to modeling design patterns and the way how to reuse them in the automation of software development. The solution envisaged here is based on combining metamodeling techniques and formal methods to represent security patterns at two levels of abstraction to fostering reuse. The goal of the paper is to advance the state of the art in model and pattern-based security for software and systems engineering in three relevant areas: (1) develop a modeling language to support the definition of security patterns using metamodeling techniques; (2) provide a formal representation and its associated validation mechanisms for the verification of security properties; and (3) derive a set of guidelines for the modeling of security patterns within the integration of these two kinds of representations.
1 Introduction
1.1 Motivation and background
During the last decades, the systems have grown in terms of complexity and connectivity. In the past security was not such a critical concern of system development teams, since it was possible to rely on the fact that a system could be easily controlled due to its limited connectivity and, in most of the cases, its dedicated focus. However, nowadays, systems are growing in terms of complexity, functionality and connectivity. The aforementioned challenges in modern system development push the Information and Communication Technologies (ICT) community to search for innovative methods and tools for serving these new needs and objectives. Regarding system security, in the cases of modern systems, the “walled-garden” paradigm is unsuitable and the traditional security concepts are ineffective, since they are based on the fact that it is possible to build a wall between the system and the outer world.
9 Conclusion
Application developers usually do not have expertise in security and dependability. Hence capturing and providing this expertise by way of security patterns has become an area of research in the last years. Security patterns shall enable the development of secure and dependable applications while at the same time liberating the developer from having to deal with the technical details. Model-driven engineering (MDE) provides a very useful contribution for the design of secure and trusted systems, since it bridges the gap between design issues and implementation concerns. Hence Security pattern integration has to be considered at some point in the MDE process.
In this paper, we have proposed an approach for security pattern modeling and validation that follows the MDE paradigm. Our approach is based on metamodeling techniques that allow to specify and validate security patterns at different levels of abstraction. A security pattern at domain-independent level allows the application developer to identify security requirements and select a respective abstract solution without specific knowledge on how the solution is designed and implemented. Thus a DIPM pattern can easily be integrated into the overall abstract system specification. Following the MDE process, the system model is then refined towards a domain-specific level, taking into account domain artifacts, concrete elements such as mechanisms to use, devices that are available, etc. Consequently, a security pattern at domain-specific level contains the respective information.
