Formal Verification of Security Pattern Composition: Application to SCADA

Information security was initially required in specific applications, however, nowadays, most companies and even individuals are interested in securing their information assets. The new requirement can be costly, especially with the high demand on security solutions and security experts. Security patterns are reusable security solutions that prove to be efficient and can help developers achieve some security goals without the need for expertise in the security domain. Some security pattern combinations can be beneficial while others are inconsistent. Model checking can be used to verify the production of combining multiple security patterns with an architecture. Supervisory control and data acquisition (SCADA) systems control many of our critical industrial infrastructures. Due to their limitations, and their augmented connectivity, SCADA systems have many unresolved security issues. In this paper, we demonstrate how we can automatically generate a secure SCADA model based on an insecure one and how to verify the generated model

A Pattern-Based Approach to Structural Design Composition

This paper describes an approach to component-based software engineering based on a formal description of design patterns. The architectural design information, captured by design patterns, is made explicit and represented in a declarative way, being packaged into tangible artifacts as building block design components in the development process. These design component descriptions can be instantiated, adapted, assembled, implemented, and maintained. Furthermore, we can use these representations to reason about properties related to the combination of design components. We illustrate the utility of our approach through a case study involving various design patterns