Achieving security assurance with assertion-based application construction

Carlos E. Rubio-Medrano, Gail-Joon Ahn, Karsten Sohr

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Scopus citations

Abstract

Modern software applications are commonly built by leveraging pre-fabricated modules, e.g. application programming interfaces (APIs), which are essential to implement the desired functionalities of software applications, helping reduce the overall development costs and time. When APIs deal with security-related functionality, it is critical to ensure they comply with their design requirements since otherwise unexpected flaws and vulnerabilities may be consequently occurred. Often, such APIs may lack sufficient specification details, or may implement a semantically-different version of a desired security model to enforce, thus possibly complicating the runtime enforcement of security properties and making it harder to minimize the existence of serious vulnerabilities. This paper proposes a novel approach to address such a critical challenge by leveraging the notion of software assertions. We focus on security requirements in role-based access control models and show how proper verification at the source-code level can be performed with our proposed approach as well as with automated state-of-the-art assertion-based techniques.

Original languageEnglish (US)
Title of host publicationCollaborateCom 2014 - Proceedings of the 10th IEEE International Conference on Collaborative Computing
Subtitle of host publicationNetworking, Applications and Worksharing
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages503-510
Number of pages8
ISBN (Electronic)9781631900433
DOIs
StatePublished - Jan 19 2015
Event10th IEEE/EAI International Conference on Collaborative Computing, CollaborateCom 2014 - Miami, United States
Duration: Oct 22 2014Oct 25 2014

Publication series

NameCollaborateCom 2014 - Proceedings of the 10th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing

Other

Other10th IEEE/EAI International Conference on Collaborative Computing, CollaborateCom 2014
CountryUnited States
CityMiami
Period10/22/1410/25/14

    Fingerprint

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Software

Cite this

Rubio-Medrano, C. E., Ahn, G-J., & Sohr, K. (2015). Achieving security assurance with assertion-based application construction. In CollaborateCom 2014 - Proceedings of the 10th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing (pp. 503-510). [7014605] (CollaborateCom 2014 - Proceedings of the 10th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.4108/icst.collaboratecom.2014.257691