MITER is a project funded by the FNR, through the CORE program.
Project Number: C10/IS/783852
From: 01/05/2011
To: 30/04/2014
Budget: 320,000.00€
Security is not only a keyword, it is currently a critical issue that has to be embraced by modern software engineering (SE) techniques. From this SE point of view, ensuring confidence in the implemented security mechanisms is the key objective when deploying a security concern. This objective can be reached by improving the design and implementation process via modeling and automation, such as security code generation from models, and by systematic testing and verification.
As stated in the FNR programme description, “Information Security and Trust Management” is one of the cornerstones of the Information Society, a “transversal” research domain of central and ever-growing importance not only for the banking industry, but for nearly all other ICT applications and e-services. Thus, security concerns impact many ICT domains in many different ways.
Secure programming techniques are now better understood and guidelines teach programmers how to avoid buffer overflows, when to validate inputs and how to apply cryptography. The key problem is that security should not be under the sole responsibility of the programmer (hopefully competent). Dealing with security at a programming level is risky, often not sufficient and is not the most productive. Indeed, to face large classes of attacks, security experts must express the security policy, which is the result of a risks and threats analysis. This security policy cannot be deployed without taking into account the software development lifecycle in a whole. In other words, it is necessary to consider the requirements, analysis and design developments phases and the links between these phases to be able to represent (with models) and analyze (with model analysis security methods) security concerns in order to detect or prevent from attacks. Second, the fact that security concerns impact many ICT domains in many different ways, amplified by the fact that economic pressure reduces development time and increases the frequency modifications are made, constantly imposes more productive and flexible development methods. To sum up, for agile modeling, there is an urgent need for modeling tools which allows composing functional, architectural and – in MITER project – security expert viewpoints into an integrated productive model.
In this context, the MITER project aims at developing new modeling techniques to 1) represent security concerns (e.g. access control and usage control policies), 2) compose them with the business logic model (called target model), and 3) test the security model composition against security requirements. These three objectives converge to an integrated model-driven security process which allows a business model to embed various security concerns, and makes these security properties testable by construction.
More specifically, the objective of the first task of the project, which is the modeling of security concerns, is to propose a portfolio of well-defined security models (specified with both structural and behavioral views) without any consideration of a target model i.e., the model in which the security models will be inserted or composed. Consequently, each security concern will be modeled in isolation leading to a better understanding and modularization of these security concerns.
The second objective of MITER is to automatically compose a subset of selected security models with the target model to obtain a new model of the system augmented of security properties. This model composition will be performed using aspect-oriented modeling approaches or model composers. Once various security models specified, the automation of the composition should allow to adapting more easily the target model to different situations by allowing the automated composition of appropriate security models.
The third objective of the MITER is to exploit the model composition operators to make the final implementation testable by construction. Composing security models/viewpoints into the target model will lead to a more detailed model, which will finally be implemented. The code production is error prone and the conformance of the implementation with the security policy must be tested. The composition operators we propose may offer an elegant way (1) to make the implemented security mechanisms testable, in the sense they can be made observable at runtime, (2) to propose a security fault model to perform mutation analysis on the final code.
These three objectives should allow the trustfully design of a large family of secure systems in an automatic and efficient way
List of the published papers related to the project:
List of the papers under-submission related to the project: