DPS : An Architectural Style for Development of Secure Software

Many claim that software systems must be designed for security. This, however, is far from being an easy task, especially for complex systems. We believe that this difficulty can be alleviated by a set of --preferably rigorous-- principles. We propose an architectural style, the Dual Protection Style (DPS), for constructing secure software. This style results from our experience in designing and implementing a distributed, multi-user, medium sized application. We present the applicability and effectiveness of our DPS style on the basis of a case study of a distributed software platform for virtual and mobile team collaboration called MOTION. We further elaborate on the description of this architectural style, its formalization and the formal verification of some of its properties.

[1]  Robyn R. Lutz,et al.  Engineering for Safety : A Roadmap , 2001 .

[2]  Ken Frazer,et al.  Building secure software: how to avoid security problems the right way , 2002, SOEN.

[3]  Gary McGraw,et al.  Securing Java: getting down to business with mobile code , 1999 .

[4]  Peter Gorm Larsen,et al.  An overview of the ISO/VDM-SL standard , 1992, SIGP.

[5]  Daniel F. Sterne,et al.  A Domain and Type Enforcement UNIX Prototype , 1995, Comput. Syst..

[6]  Premkumar T. Devanbu,et al.  Software engineering for security: a roadmap , 2000, ICSE '00.

[7]  Anthony Hall,et al.  Correctness by Construction: Developing a Commercial Secure System , 2002, IEEE Softw..

[8]  Gian Pietro Picco,et al.  PeerWare: Core Middleware Support for Peer-to-Peer and Mobile Systems , 2001 .

[9]  Harald C. Gall,et al.  Visual requirements validation: case study in a CORBA-supported environment , 2002, Proceedings IEEE Joint International Conference on Requirements Engineering.

[10]  Antoni Diller,et al.  Z - an introduction to formal methods , 1990 .

[11]  Mary Shaw,et al.  Software architecture - perspectives on an emerging discipline , 1996 .

[12]  M. P. Ressler.  Security sensitive software development , 1989, Proceedings. International Carnahan Conference on Security Technology.

[13]  Brian W. Kernighan,et al.  The UNIX™ programming environment , 1979, Softw. Pract. Exp..

[14]  Gerald Reif,et al.  A service architecture for mobile teamwork , 2002, SEKE '02.

[15]  James A. Whittaker,et al.  Building software securely from the ground up , 2002, IEEE Software.

[16]  Li Gong,et al.  User authentication and authorization in the Java/sup TM/ platform , 1999, Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99).

[17]  David LeBlanc,et al.  Writing Secure Code , 2001 .

[18]  Joseph W. Yoder,et al.  Architectural Patterns for Enabling Application Security , 1998 .

[19]  Jens Palsberg,et al.  Scalable propagation-based call graph construction algorithms , 2000, OOPSLA '00.

[20]  Daniel Jackson,et al.  Alloy: a lightweight object modelling notation , 2002, TSEM.

[21]  P. C. Fenkam,et al.  Dynamic user management system for web sites , 2000 .

[22]  Gerald Reif,et al.  A Web-based peer-to-peer architecture for collaborative nomadic working , 2001, Proceedings Tenth IEEE International Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises. WET ICE 2001.

[23]  C. A. R. Hoare,et al.  Communicating Sequential Processes (Reprint) , 1983, Commun. ACM.