As software architectures become increasingly complex, securing them against cybersecurity attacks has become a critical and challenging aspect of application design. This paper introduces a formal framework for the automatic enforcement of security patterns in software architecture, specifically targeting improper authorization vulnerabilities. Improper authorization occurs when access to sensitive resources violates the current access control policy. Using the Alloy framework, our approach identifies key architectural points from detected vulnerabilities. These architectural points are then used to guide the effective enforcement of appropriate security patterns that mitigate the identified vulnerabilities. We demonstrate the proposed approach through a case study in a vulnerable web application, where an authorization pattern is enforced to prevent unauthorized access. By automating this enforcement process, our method contributes to formalize the security design by reducing the reliance on manual security analysis.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Toward Automatic Enforcement of Security Patterns in Software Architecture Using Alloy

  • Quentin Rouland,
  • Kamel Adi,
  • Omer Nguena Timo,
  • Luigi Logrippo

摘要

As software architectures become increasingly complex, securing them against cybersecurity attacks has become a critical and challenging aspect of application design. This paper introduces a formal framework for the automatic enforcement of security patterns in software architecture, specifically targeting improper authorization vulnerabilities. Improper authorization occurs when access to sensitive resources violates the current access control policy. Using the Alloy framework, our approach identifies key architectural points from detected vulnerabilities. These architectural points are then used to guide the effective enforcement of appropriate security patterns that mitigate the identified vulnerabilities. We demonstrate the proposed approach through a case study in a vulnerable web application, where an authorization pattern is enforced to prevent unauthorized access. By automating this enforcement process, our method contributes to formalize the security design by reducing the reliance on manual security analysis.