Model-Driven Security with A System of Aspect-Oriented Security Design Patterns

Abstract

Model-Driven Security (Mds) has emerged for more than a decade to propose sound Md methodologies for supporting secure systems development. Yet, there is still a big gap before making Mds more easily applicable, and adoptable by industry. Most current Mds approaches have not extensively dealt with multiple security concerns but rather a specific one, e.g. authorization. Besides, security patterns which are based on domain-independent, time-proven security knowledge and expertise, can be considered as reusable security bricks upon which sound and secure systems can be built. But security patterns are not applied as much as they could be because developers have problems in selecting them and applying them in the right places, especially at the design phase. In this position paper, we propose an exploratory Mds approach based on a System of aspect-oriented Security design Patterns (shortly called SoSPa) in which security design patterns are collected, specified as reusable aspect models to form a coherent system of them that guides developers in systematically selecting the right security design patterns for the job. Our Mds approach allows the selected security design patterns to be automatically composed with the target system model. The woven secure system model can then be used for (partial) code generation, including (configured) security infrastructures.