Security Contracts a Property-Based Approach to Support Security Patterns - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2024

Security Contracts a Property-Based Approach to Support Security Patterns

Résumé

Security patterns represent reusable solutions and best practices intended to avoid security-related flaws in software and system designs. Unfortunately, the implementation and enforcement of these patterns remains a complex and error-prone task. As a consequence, and besides implementing a given security pattern, applications often remain insecure w.r.t. the security risk they intended to tackle. This is so for two main reasons: 1) patterns are rarely re-usable without adaptation, and thus concrete implementations may fail to deal with a number of (often implicit) properties, which must hold in order for the pattern to be effective; 2) patterns are deployed in environments with uncertainties that can only be known at runtime. In order to deal with this problem, we propose here Security Contracts, a framework that permits the specification and runtime monitoring of security patterns and related properties (including temporal ones) in both new and existing applications. It is based on an extension of the Design-by-Contract paradigm to enable the specification of security patterns and the runtime adaptation of applications. We demonstrate the feasibility of our approach with an implementation and its evaluation on a framework used worldwide in web technologies, Spring.

Dates et versions

hal-04578756 , version 1 (17-05-2024)

Identifiants

Citer

Sylvain Guérin, Joël Champeau, Salvador Martínez, Raul Mazo. Security Contracts a Property-Based Approach to Support Security Patterns. 10th International Conference on Information Systems Security and Privacy, Feb 2024, Rome, France. pp.103-111, ⟨10.5220/0012305600003648⟩. ⟨hal-04578756⟩
0 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More