Meeting confidentiality requirements in software systems is vital for organizations. Considering confidentiality in early development phases such as the architectural design phase is beneficial compared to late phases such as the implementation because fixing design issues is more cost-efficient in early phases. This tutorial introduces an approach for modeling and statically analyzing confidentiality in software architectures within the Palladio tool suite. Besides foundational knowledge, the tutorial provides a practical hands-on session using the tool. The goal is to show that it is already possible to consider confidentiality in the early design process and that this consideration can be integrated into existing architectural design tools

Hahner, S.

Heinrich R., Weyns D. Weyns D., Mirandola R.

Heinrich, R.

Reussner, R.

Seifermann, S.

Walter, M.

English

KITopen

Identifying Confidentiality Violations inArchitectural Design Using PalladioStephan Seifermanna, Maximilian Waltera, Sebastian Hahnera,Robert Heinricha and Ralf ReussneraaKASTEL – Institute of Information Security and Dependability, Karlsruhe Institute of Technology (KIT), GermanyAbstractMeeting confidentiality requirements in software systems is vital for organizations. Considering confi-dentiality in early development phases such as the architectural design phase is beneficial compared tolate phases such as the implementation because fixing design issues is more cost-efficient in early phases.This tutorial introduces an approach for modeling and statically analyzing confidentiality in softwarearchitectures within the Palladio tool suite. Besides foundational knowledge, the tutorial provides apractical hands-on session using the tool. The goal is to show that it is already possible to considerconfidentiality in the early design process and that this consideration can be integrated into existingarchitectural design tools.KeywordsConfidentiality, Architectural Design, Palladio1. MotivationThe importance of security in software sys-tems continuously increases together withthe connectedness of systems and legal obli-gations. Breaches of confidentiality, which isan aspect of security, have a significant im-pact on business because of a loss of busi-ness value [1] or high fines [2, 3]. Addition-ally, many users are willing to change a ser-vice provider to increase the confidentialityof their data [4]. Therefore, protecting dataconfidentiality is vital for organizations.It is necessary to consider confidentialityin all development phases and as early asVäxjö’21: European Conference on Software Architecture,September 13–17, 2021, Växjö, Sweden" stephan.seifermann@kit.edu (S. Seifermann);maximilian.walter@kit.edu (M. Walter);sebastian.hahner@kit.edu (S. Hahner);robert.heinrich@kit.edu (R. Heinrich);ralf.reussner@kit.edu (R. Reussner)© 2021 Copyright for this paper by its authors. Use permit-ted under Creative Commons License Attribution 4.0 Inter-national (CC BY 4.0).CEURWorkshopProceedingshttp://ceur-ws.orgISSN 1613-0073CEUR Workshop Proceedings(CEUR-WS.org)possible, because many violations trace backto the software design [5, 6], which also in-cludes early designs such as software archi-tectures. To avoid high effort for later fixes,it is necessary to already identify and addressthese issues in the software architecture [7].Even if this line of arguments is clear or evenobvious to many, there is still a low adoptionof security tools during the software designor architecture [8, 9, 10, 11]. There are var-ious reasons to this low adoption but miss-ing awareness and integration into existingworkflows are two of them.The goal of the tutorial is to raise aware-ness and to make clear that approaches,which blend into existing tools and pro-cesses, exist. We would like to show this bypresenting our confidentiality modeling andanalysis approach integrated into the Palla-dio tool suite [12]. The Palladio integrationextends the modeling language by means forexpressing data processing. A automatedtransformation translates the Palladio modelinto an analysis model that determines rel-evant data properties by simulating the ef-fect of data processing on data. Eventually,data properties are compared with expectedproperties and the identified problems are re-ported back to the user.2. Tutorial OverviewIn this tutorial, we show how static analy-ses of software architectures can reveal vio-lations of access control policies. The threatsconsidered in the analyses are that the soft-ware architecture itself violates such policiesby its structure, behavior, deployment or in-tended usage.The tutorial is built around our modelingand analysis approach [13, 14]. The approachis integrated into the Palladio tool suite [12]and makes use of recently introduced data-oriented interfaces [15]. The approach hasalready been used in various contexts, so weconsider it mature enough for the presenta-tion as part of the tutorial. For instance, theapproach has been used to identify read andwritten data as part of an alignment processbetween business processes and software ar-chitectures focused on access rights [16, 17]as well as for deriving properties of processeddata that can speed up runtime analyses [18].The tutorial consists of three parts: First,we introduce the modeling concepts to repre-sent system behavior that can be analyzed foraccess control later. This includes a hands-onsession on modeling using our Palladio tool-ing. Second, we explain how to formulatean access control analysis using a previouslypublished domain-specific language [19] andhow to interpret the results. Again, this in-cludes a hands-on session on analyzing thepreviously modeled system using our Palla-dio tooling. We recap all required founda-tional knowledge, so no expertise on securityor Palladio is required. Third, we will brieflyrecap the contents of the tutorial, give an out-look on ideas and first results of future work.3. Tutorial MaterialThe tutorial will use slides, ready to use Palla-dio tooling and example models. All materialwill be published on the companion websiteof the tutorial1 and in a data set [20].The example discussed in the tutorial is theTravelPlanner system known from the iFlowapproach [21]. The interactions in the sys-tem are visualized by the sequence diagramin Figure 1. Simply said, a user looks fora flight and books the flight by additionallypassing credit card information (ccd) to thesystem. The system consists of the smart-phone apps TravelPlanner and CreditCard-Center. The travel planner mediates betweenthe user and a travel agency, as well as an air-line. The credit card center safely stores thecredit card information of the user. The Trav-elAgency supports the search for flights andreceives a comission from the airline after abooking. The Airline provides informationabout flights and supports booking flights. Inthe corresponding publication [21], the con-fidentiality requirement is given by an in-formation flow policy. Transmitted data hasa classification level and participants have aclearance level. The levels are {User, Airline,TravelAgency}, {User, Airline} and {User} in as-cending order. The requirement is that nodata must receive at a participant, which hasa clearance level lower than the classifica-tion level of the data. In the example, thecritical part is the transmission of the creditcard information, which is classified as User,to the airline, which only has a clearance{User,Airline}.In the tutorial, we use a modified versionof the scenario described before, which wepublished as part of a previous publication1https://fluidtrust.github.io/tutorial-ecsa2021/acceptComission(commission)findFlights(criteria)flightsfindFlights(query)flightsgetCCD()ccdreleaseCCDForAirline()bookFlight(flight, ccd)confirmationbookFlight(flight, ccd)confirmationconfirmation:TravelPlanner :CreditCardCenter :TravelAgency :AirlinefindFlights(criteria)flightsccdFigure 1: UML sequence diagram illustrating the TravelPlanner system.[13]. Instead of an information flow pol-icy, we formulate the confidentiality require-ments in terms of Role-based Access Con-trol (RBAC). Participants have roles insteadof clearance levels and data have associatedaccess rights in terms of roles. The roles areUser, TravelAgency and Airline. The require-ment is that the intersection between the ac-cess rights of data and the roles of a partic-ipant must not be empty. Again, the criticalpart is that credit card data is only accessibleto the user but it is sent to the airline duringthe booking.In both examples, it is possible to explicitlyrelease the credit card information on behalfof the user. This action reduces the classifica-tion level or add the Airline role, respectively.The analysis to be defined during the tutorial,detects the violation of the access control pol-icy if the credit card information is passed tothe airline without previous release. A miss-ing call to the release service implies an errorin the planned behavior of the architectureand has to be fixed.4. Future WorkWe already discovered several interesting ar-eas for further research: Architecture-levelconfidentiality analyses are affected by un-certainty due to abstraction and lack of in-formation at design time. Therefore, we planto make uncertainty explicit while modeling,refining and analyzing access control policies[22]. A considerable source of uncertaintyis implied by the execution context of thesystem under analysis. Therefore, it is rea-sonable to identify and consider relevant as-pects of the context [23]. Additional, mali-cious users or attackers could exist. Thesecould exploit vulnerabilities or policies andtherefore should be considered in the future.AcknowledgementsThis work is funded by the DFG (Ger-man Research Foundation) – project number432576552, HE8596/1-1 (FluidTrust) and alsosupported by funding of the Helmholtz Asso-ciation (HGF) through the Competence Cen-ter for Applied Security Technology (KAS-TEL) (46.23).References[1] H. Weisbaum, Trust in Facebookhas dropped by 66 percent since theCambridge Analytica scandal, 2018.URL: https://www.nbcnews.com/business/consumer/trust-facebook-has-dropped-51-percent-cambridge-analytica-scandal-n867011, accessed2021-07-09.[2] E. Denham, COM0783542, Penatly No-tice, UK Information Commissioner’sOffice, 2020.[3] E. Denham, COM0804337, Penatly No-tice, UK Information Commissioner’sOffice, 2020.[4] Cisco Systems, Inc., Con-sumer Privacy Survey, Tech-nical Report, Cisco, 2019. URL:https://www.cisco.com/c/dam/global/en_uk/products/collateral/security/cybersecurity-series-2019-cps.pdf,accessed 2021-07-09.[5] R. Kuhn, et al., It Doesn’t Have to BeLike This: Cybersecurity VulnerabilityTrends, IT Professional 19 (2017) 66–70.[6] G. McGraw, Software Security - Build-ing Security In, Addison-Wesley Profes-sional, 2006.[7] F. Shull, et al., What we have learnedabout fighting defects, in: METRICS,IEEE, 2002, pp. 249–258.[8] H. Assal, et al., Security in the softwaredevelopment lifecycle, in: SOUPS’18,USENIX Association, 2018, pp. 281–296.[9] H. Assal, et al., ’Think secure fromthe beginning’: A Survey with SoftwareDevelopers, in: CHI’19, 2019, pp. 1–13.[10] J. A. Davis, et al., Study on the Barri-ers to the Industrial Adoption of FormalMethods, in: Formal Methods for Indus-trial Critical Systems, LNCS, Springer,2013, pp. 63–77.[11] H. Garavel, et al., The 2020 Expert Sur-vey on Formal Methods, in: FormalMethods for Industrial Critical Systems,LNCS, Springer, 2020, pp. 3–69.[12] R. H. Reussner, et al., Modeling and Sim-ulating Software Architectures - ThePalladio Approach, MIT Press, 2016.[13] S. Seifermann, et al., Data-Driven Soft-ware Architecture for Analyzing Confi-dentiality, in: ICSA’19, IEEE, 2019, pp.1–10.[14] S. Seifermann, et al., A UnifiedModel to Detect Information Flowand Access Control Violations in Soft-ware Architectures, in: SECRYPT’21,SCITEPRESS, 2021, pp. 26–37.[15] D. Werle, et al., Data Stream Op-erations as First-Class Entities inComponent-Based Performance Mod-els, in: ECSA’20, LNCS, Springer, 2020,pp. 148–164.[16] R. Pilipchuk, et al., Aligning BusinessProcess Access Control Policies withEnterprise Architecture, in: CECC’18,2018, pp. 17:1–17:4.[17] R. Pilipchuk, et al., Challenges inAligning Enterprise Application Archi-tectures to Business Process AccessControl Requirements in EvolutionalChanges, in: ICE-B’21, ScitePress, 2021,pp. 13–24.[18] R. Al-Ali, et al., Dynamic Security Rulesfor Legacy Systems, in: ECSA’19 - Vol-ume 2, 2019, pp. 277–284.[19] S. Hahner, et al., Modeling data flowconstraints for design-time confiden-tiality analyses, in: ICSA’21 - Compan-ion, 2021, pp. 15–21.[20] S. Seifermann, et al., Auxiliar material,2021. doi:10.5281/zenodo.5086778.[21] K. Katkalov, et al., Model-Driven De-velopment of Information Flow-SecureSystems with IFlow, in: SocialCom’13,2013, pp. 51–56.[22] S. Hahner, Architectural access controlpolicy refinement and verification un-der uncertainty, in: ECSA’21, 2021. Ac-cepted, to appear.[23] N. Boltz, et al., Context-Based Con-fidentiality Analysis for Industrial IoT,in: SEAA’20, 2020, pp. 589–596.

Identifying confidentiality violations in architectural design using palladio

https://publikationen.bibliothek.kit.edu/1000139806/134433825

Identifying confidentiality violations in architectural design using palladio

Abstract

Similar works

Full text

Available Versions

KITopen