An Approach to Analyze Vulnerability of Information Flow in Software Architecture
Source abstract
Abstract
Current research on software vulnerability analysis mostly focus on source codes or executable programs. But these methods can only be applied after software is completely developed when source codes are available. This may lead to high costs and tremendous difficulties in software revision. On the other hand, as an important product of software design phase, architecture can depict not only the static structure of software, but also the information flow due to interaction of components. Architecture is crucial in determining the quality of software. As a result, by locating the architecture-level information flow that violates security policies, vulnerabilities can be found and fixed in the early phase of software development cycle when revision is easier with lower cost. In this paper, an approach for analyzing information flow vulnerability in software architecture is proposed. First, the concept of information flow vulnerability in software architecture is elaborated. Corresponding security policies are proposed. Then, a method for constructing service invocation diagrams based on graph theory is proposed, which can depict information flow in software architecture. Moreover, an algorithm for vulnerability determination is designed to locate architecture-level vulnerabilities. Finally, a case study is provided, which verifies the effectiveness and feasibility of the proposed methods.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Information and Cyber Security · Software Reliability and Analysis Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
The Key Laboratory on Reliability and Environmental Engineering Technology, Beihang University, Beijing 100191, China
School of Reliability and Systems Engineering, Beihang University, Beijing 100191, China
China Academy of Electronics and Information Technology, China Electronics Technology Group Corporation, Beijing 100041, China
Funding
National Key Laboratory of Science &Technology on Reliability &Environmental Engineering of China
References (68)
Show source-provided references
1. Seresht, S.M. (2009). A Methodology for Software Requirements Elicitation and Analysis: Semi-Automatic Assistance in Elicitation and Analysis of Textual User Requirements, VDM Verlag.
2. Krsul, I.V. (1998). Software Vulnerability Analysis, Purdue University.
3. A review on software and network security
4. Advances in software vulnerability analysis techniques
5. Survey of Software Vulnerability Detection Techniques
6. Pressman, R. (2014). Software Engineering: A Practitioner’s Approach, McGraw-Hill. [8th ed.].
7. A review of software architecture
8. Shaw, M., and Garlan, D. (1996). Software Architecture: Perspectives on an Emerging Discipline, Prentice-Hall, Inc.
9. System architecting and design space characterization10.1002/sys.21439 ↗
10. Sinha, K., Han, S.Y., and Suh, E.S. (2019). Design structure matrix-based modularization approach for complex systems with multiple design constraints. Syst. Eng.10.1002/sys.21518 ↗
11. Methods for evaluating software architecture-A survey
12. Software Architecture Evaluation10.3724/SP.J.1001.2008.01328 ↗
13. Jürjens, J. (2002). UMLsec: Extending UML for Secure Systems Development. UML 2002, Proceedings of the 5th International Conference on The Unified Modeling Language, Dresden, Germany, 30 September–4 October 2003, Springer.10.1007/3-540-45800-X_32 ↗
14. An approach for modeling and analysis of security system architectures10.1109/TKDE.2003.1232267 ↗
15. Sharma, V.S., and Trivedi, K.S. (2005, January 12–14). Architecture based analysis of performance, reliability and security of software systems. Proceedings of the International Workshop on Software and Performance, Wosp 2005, Palma, Illes Balears, Spain.10.1145/1071021.1071046 ↗
16. Banerjee, S., Mattmann, C.A., Medvidovic, N., and Golubchik, L. (2005, January 15–16). Leveraging architectural models to inject trust into software systems. Proceedings of the Workshop on Software Engineering for Secure Systems—Building Trustworthy Applications, St. Louis, MO, USA.10.1145/1083200.1083213 ↗
17. Fernandez, E.B. (2013). Security Patterns in Practice: Designing Secure Architectures Using Software Patterns, Wiley Publishing.
18. Jie, R., Taylor, R.N., Dourish, P., and Redmiles, D.F. (2005, January 15–16). Towards an architectural treatment of software security: A connector-centric approach. Proceedings of the SESS 2005 Workshop on Software Engineering for Secure Systems—Building Trustworthy Applications, St. Louis, MO, USA.
19. Shin, M.E., Malhotra, B., Gomaa, H., and Kang, T. (2012, January 1–3). Connectors for secure software architectures. Proceedings of the 24th International Conference on Software Engineering and Knowledge Engineering(SEKE 2012), San Francisco, CA, USA.
20. Kazman, R., and Woody, C. (2016, February 04). Identifying the Architectural Roots of Vulnerabilities. Available online: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=451035.
21. Software Architecture Risk Analysis (SARA): A Methodology to Assess Security Risks in Software Architectures, and an Application
22. Denning, D.E.R. (1982). Cryptography and Data Security, Addison-Wesley Longman Publishing Co., Inc.
23. Bishop, M., and Bailey, D. (1996, December 29). A Critical Analysis of Vulnerability Taxonomies. Available online: https://www.cs.ucdavis.edu/research/tech-reports/1996/CSE-96-11.pdf.10.21236/ADA453251 ↗
24. Pieprzyk, J., Hardjono, T., and Seberry, J. (1994). Fundamentals of Computer Security Technology, Springer.
25. Al-Azzani, S., and Bahsoon, R. (2012, January 20–24). SecArch: Architecture-level Evaluation and Testing for Security. Proceedings of the 2012 Joint Working IEEE/IFIP Conference on Software Architecture and European Conference on Software Architecture, Helsinki, Finland.10.1109/WICSA-ECSA.212.13 ↗
26. Karppinen, K., Lindvall, M., and Yonkwa, L. (2008, January 9–11). Detecting Security Vulnerabilities with Software Architecture Analysis Tools. Proceedings of the 2008 IEEE International Conference on Software Testing Verification and Validation Workshop, Lillehammer, Norway.10.1109/ICSTW.2008.14 ↗
27. Vulnerability analysis of software structure
28. Simulation and verification of C4ISR architecture based on UML&OPN
29. Xu, Z. (2009). Static Analysis of C Program, Institute of Software Chinese Academy of Sciences.
30. Larochelle, D., and Evans, D. (2001, January 13). Statically Detecting Likely Buffer Overflow Vulnerabilities. Proceedings of the SSYM 2001 10th conference on USENIX Security Symposium, Berkeley, CA, USA.
31. Xie, Y., Chou, A., and Engler, D. (2003, January 1–5). ARCHER: Using symbolic, path-sensitive analysis to detect memory access errors. Proceedings of the European Software Engineering Conference Held Jointly with Acm Sigsoft International Symposium on Foundations of Software Engineering, Helsinki, Finland.10.1145/949952.940115 ↗
32. Zhang, D., Liu, D., Wang, W., Lei, J., Kung, D., and Csallner, C. (2010, January 29–31). Testing C Programs for Vulnerability Using Trace-Based Symbolic Execution and Satisfiability Analysis. Proceedings of the International Conference on Computational Science and Engineering, Vancouver, BC, Canada.
33. Ganapathy, V., Jha, S., Ch, D., Melski, D., and Vitek, D. (2003, January 27–30). Buffer Overrun Detection using Linear Programming and Static Analysis. Proceedings of the 10th ACM conference on Computer and communications security, Washington, DC, USA.10.1145/948109.948155 ↗
34. Aiken, A. (1999). Constraint-Based Program Analysis, Springer.
35. Nelson, G. (2002, January 17–19). Extended Static Checking for Java. Proceedings of the International Conference on Mathematics of Program Construction, Marstrand, Sweden.
36. Saturn: A scalable framework for error detection using Boolean satisfiability10.1145/1232420.1232423 ↗
37. Network flows—Theory, algorithms and applications
38. Managing the interstitials, a System of Systems framework suited for the Ballistic Missile Defense System10.1002/sys.20173 ↗
39. Raz, A.K., and DeLaurentis, D.A. (2015, January 5). A System-of-Systems Perspective on Information Fusion Systems: Architecture Representation and Evaluation. Proceedings of the AIAA Infotech @ Aerospace, Kissimmee, FL, USA.10.2514/6.2015-0644 ↗
40. Importance degree and recovery policies for components of system of system based on resilience
41. Zhang, Y., Rui, K., Li, R., Yang, C., and Yi, Y. (2016, January 19–21). Resilience-based component importance measures for complex networks. Proceedings of the 2016 Prognostics and System Health Management Conference (PHM-Chengdu), Chengdu, China.10.1109/PHM.2016.7819761 ↗
42. Analysis of information flow security in cyber–physical systems10.1016/j.ijcip.2010.09.001 ↗
43. Bug propagation and debugging in asymmetric software structures10.1103/PhysRevE.70.046109 ↗
44. Mohamed, A., and Zulkernine, M. (2008, January 12–13). On Failure Propagation in Component-Based Software Systems. Proceedings of the 2008 QSIC The Eighth International Conference on Quality Software, Oxford, UK.10.1109/QSIC.2008.46 ↗
45. Model for Cascading Faults in Complex Software10.3724/SP.J.1016.2011.01137 ↗
46. Software quality measurement based on error propagation analysis in software networks
47. Modeling Complex Collaboration Network for Service-Oriented Software Based on Execution Behaviors
48. A lattice model of secure information flow10.1145/360051.360056 ↗
49. Survey on Information Flow Control
50. Dependable computing model based on lattice
51. Mclean, J., Schell, R.R., and Brinkley, D.L. (2002). Security Models, John Wiley & Sons, Inc.10.1002/0471028959.sof297 ↗
52. Secure Computer Systems: A Mathematical Model
53. Biba, K.J. (1977). Integrity Considerations for Secure Computer Systems, Purdue University. Purdue University Reports and Papers Archive.
54. Erl, T. (2007). SOA Principles of Service Design, Prentice Hall.
55. Bovet, D., Cesati, M., and Oram, A. (2002). Understanding the Linux Kernel, O’Reilly & Associates, Inc.. [2nd ed.].
56. Rabhi, F.A., and Gorlatch, S. (2003). Towards Patterns of Web Services Composition. Patterns and Skeletons for Parallel and Distributed Computing, Springer.10.1007/978-1-4471-0097-3 ↗
57. Aho, A.V., Sethi, R., and Ullman, J.D. (2008). Compilers Principles, Techniques and Tools, Addison-Wesley Longman Publishing Co., Inc.
58. Tang, F. (2005). Data Structures, Beihang University Press. [2nd ed.].
59. ISO/IEC (2008). ISO/IEC 27000:2018 Information Technology—Security Techniques—Information Security Management Systems, ISO/IEC.
60. ISO/IEC (2009). ISO/IEC 15408:2009 Information Technology—Security Techniques—Evaluation Criteria for IT, ISO/IEC.
61. IOS/IEC (2005). Information Technology-Security Techniques-Code of Practice for Information Security Management, IOS/IEC.
62. China National Standards (2008). Information Security Technology Classification Guide for Classified Protection of Information System, Standardization Administration of China. GB/T 22240-2008.
63. Calinescu, R. (2013). Emerging Techniques for the Engineering of Self-Adaptive High-Integrity Software, Springer.10.1007/978-3-642-36249-1_11 ↗
64. Paganini, P. (2019, January 16). Critical bug in Amadeus Flight Booking System Affects 141 Airlines. Available online: https://securityaffairs.co/wordpress/79972/hacking/amadeus-flight-booking-system-bug.html.
65. Surface Roughness Modeling and Optimization of Tungsten-copper Alloys in Micro-milling Processes10.1016/j.measurement.2016.03.002 ↗
66. Correlation of the holes quality with the force signals in a microdrilling process of a sintered tungsten-copper alloy10.1007/s12541-014-0532-5 ↗
67. Sensor Reliability in Cyber-Physical Systems Using Internet-of-Things Data: A Review and Case Study10.3390/rs11192252 ↗
68. Self-Tuning Method for Increased Obstacle Detection Reliability Based on Internet of Things LiDAR Sensor Models10.3390/s18051508 ↗