Flaws in Flows: Unveiling Design Flaws via Information Flow Analysis
Paper i proceeding, 2019

This paper presents a practical and formal approach to analyze security-centric information flow policies at the level of the design model. Specifically, we focus on data confidentiality and data integrity objectives. In its guiding principles, the approach is meant to be amenable for designers (e.g., software architects) that have very limited or no background in formal models, logics, and the like. To this aim, we provide an intuitive graphical notation, which is based on the familiar Data Flow Diagrams, and which requires as little effort as possible in terms of extra security-centric information the designer has to provide. The result of the analysis algorithm is the early discovery of design flaws in the form of violations of the intended security properties. The approach is implemented as a publicly available plugin for Eclipse and evaluated with four real-world case studies from publicly available literature.

Secure design

Integrity

Data Flow Diagram

Confidentiality

Författare

Katja Tuma

Chalmers, Data- och informationsteknik, Software Engineering, Software Engineering for Cyber Physical Systems

Riccardo Scandariato

Chalmers, Data- och informationsteknik, Software Engineering, Software Engineering for Cyber Physical Systems

Musard Balliu

Kungliga Tekniska Högskolan (KTH)

Chalmers, Data- och informationsteknik, Informationssäkerhet

Proceedings - 2019 IEEE International Conference on Software Architecture, ICSA 2019

191-200

International Conference on Software Architecture (ICSA)
Hamburg, Germany,

Holistiskt angreppssätt att förbättra datasäkerhet (HoliSec)

VINNOVA, 2016-04-01 -- 2019-03-31.

Ämneskategorier

Annan data- och informationsvetenskap

Datavetenskap (datalogi)

Datorsystem

DOI

10.1109/ICSA.2019.00028

ISBN

9781728105284

Mer information

Senast uppdaterat

2020-12-03