Gerking, Christopher

Koziolek, Anne

Schaefer, Ina

Schubert, David

Seidl, Christoph

English

KITopen

Component-Based Refinement and Verification ofInformation-Flow Security Policies for Cyber-PhysicalMicroservice ArchitecturesChristopher Gerking 1, David Schubert2Abstract: This publication is based on our paper presented at the IEEE International Conference onSoftware Architecture 2019 [GS19].Keywords: security policy; information flow; microservice architecture; cyber-physical systems1 Composable Security for Cyber-Physical SystemsCyber-physical systems (CPS) are closely interconnected with the outside world, exchanginginformation with different parties. From a security viewpoint, it is therefore crucial forsoftware engineers to ensure that confidential information is never leaked to unauthorizedthird parties. To protect CPS against such security leaks, the flow of information mustbe regulated and analyzed in the early design phase. Formal methods for regulation andanalysis are provided by the theory of information-flow security. Due to the popularity ofcomponent-based design principles (e.g., such as the microservice architectural style), thesoftware of CPS is increasingly composed of multiple components. Thus, each componentmust be provided with an individual security policy that regulates the flow of informationbetween the component’s interfaces. To satisfy the security regulations of the compositesystem, these policies must be composable in a way that prevents unauthorized informationflows from end to end.However, the composability of properties like security is a problem that requires carefulinvestigation by software engineers. Over the last decade, secure information flow hasbecome known as a so-called hyperproperty [CS10]. Due to their formal characteristics,such properties are hard to compose in general. Therefore, a careless composition of securecomponents is at risk of leading to an insecure system [Ma02]. In our publication [GS19],we provided software engineers with means to ensure the composability of information-flow security in the presence of domain-specific CPS characteristics. Thereby, we enablemicroservice architectures of CPS to be composed securely. Our contributions address bothregulation and analysis of the information flow.1 Karlsruhe Institute of Technology (KIT), Software Design and Quality, Am Fasanengarten 5, 76131 Karlsruhe,Germany, christopher.gerking@kit.edu, httpsȷ//orcid.org/0000-0001-5531-96072 Fraunhofer Institute for Mechatronic Systems Design (IEM), Software Engineering and IT Security, Zukun-ftsmeile 1, 33102 Paderborn, Germany, david.schubert@iem.fraunhofer.decba doi:10.18420/SE2021_10Anne Koziolek, Ina Schaefer, Christoph Seidl (Hrsg.): Software Engineering 2021,Lecture Notes in Informatics (LNI), Gesellschaft für Informatik, Bonn 2021 432 Refining Information-Flow RegulationsAs our first contribution, we address the refinement of security regulations during thedecomposition of systems into components. To this end, we provide software engineerswith a set of architectural well-formedness rules for the security policies of components.These rules are used to distinguish regular refinements from those that are irregular becausethey put the composite system at risk of unauthorized information flows. Our work is basedon a well-founded theory of composability for information-flow properties [Ma02], butapplies these theoretical foundations to the engineering practice at the architectural level.To ensure applicability in the domain of CPS, our rule set is tailored to the asynchronouscommunication between components, exchanging information by passing messages to eachother. Applying our rules ensures that, as long as all constituent components adhere to theirrefined security policies, the composite system is free of any information leaks.3 Timing-Sensitive Analysis of the Information FlowOur second contribution is a tool-supported verification technique that enables engineersto analyze the message-passing behavior of a component for unauthorized informationflows. To account for the fact that CPS are real-time systems, our technique is timing-sensitive. Thus, it detects so-called timing channels, which are information leaks that areexploitable by observing the instant of time at which messages are passed. In combination,our contributions enable a compositional security analysis, in which the analysis results aresecurely composable out of the box [Ge20]. Thereby, we assure software engineers that acomposition of secure components is riskless because it will always lead to a secure system.To evaluate the accuracy of our contributions, we conducted a security-related extension ofthe community case study CoCoME for component-based systems.References[CS10] Clarkson, M. R.; Schneider, F. B.ȷ Hyperproperties. Journal of Computer Security18/6, pp. 1157–1210, 2010, doiȷ 10.3233/JCS-2009-0393.[Ge20] Gerking, C.ȷ Model-driven information flow security engineering for cyber-physical systems, PhD thesis, Paderborn University, 2020, doiȷ 10.17619/UNIPB/1-1033.[GS19] Gerking, C.; Schubert, D.ȷ Component-Based Refinement and Verification ofInformation-Flow Security Policies for Cyber-Physical Microservice Architectures.Inȷ IEEE International Conference on Software Architecture, Proceedings. ICSA2019. IEEE, pp. 61–70, 2019, doiȷ 10.1109/ICSA.2019.00015.[Ma02] Mantel, H.ȷ On the Composition of Secure Systems. Inȷ 2002 IEEE Symposiumon Security and Privacy, Proceedings. IEEE Computer Society, pp. 88–101, 2002,doiȷ 10.1109/SECPRI.2002.1004364.44 Christopher Gerking, David Schubert

Component-Based Refinement and Verification of Information-Flow Security Policies for Cyber-Physical Microservice Architectures

https://publikationen.bibliothek.kit.edu/1000142763/144924978

Component-Based Refinement and Verification of Information-Flow Security Policies for Cyber-Physical Microservice Architectures

Abstract

Similar works

Full text

Available Versions

KITopen