Abstract security patterns and the design of secure systems

Eduardo B. Fernandez*, Nobukazu Yoshioka, Hironori Washizaki, Joseph Yoder

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

Abstract

During the initial stages of software development, the primary goal is to define precise and detailed requirements without concern for software realizations. Security constraints should be introduced then and must be based on the semantic aspects of applications, not on their software architectures, as it is the case in most secure development methodologies. In these stages, we need to identify threats as attacker goals and indicate what conceptual security defenses are needed to thwart these goals, without consideration of implementation details. We can consider the effects of threats on the application assets and try to find ways to stop them. These threats should be controlled with abstract security mechanisms that can be realized by abstract security patterns (ASPs), that include only the core functions of these mechanisms, which must be present in every implementation of them. An abstract security pattern describes a conceptual security mechanism that includes functions able to stop or mitigate a threat or comply with a regulation or institutional policy. We describe here the properties of ASPs and present a detailed example. We relate ASPs to each other and to Security Solution Frames, which describe families of related patterns. We show how to include ASPs to secure an application, as well as how to derive concrete patterns from them. Finally, we discuss their practical value, including their use in “security by design” and IoT systems design.

Original languageEnglish
Article number7
JournalCybersecurity
Volume5
Issue number1
DOIs
Publication statusPublished - 2022 Dec

Keywords

  • IoT systems design
  • Secure software architecture
  • Secure software development
  • Security patterns
  • Security requirements

ASJC Scopus subject areas

  • Software
  • Information Systems
  • Computer Networks and Communications
  • Artificial Intelligence

Fingerprint

Dive into the research topics of 'Abstract security patterns and the design of secure systems'. Together they form a unique fingerprint.

Cite this