Extending a secure development methodology to distributed systems Yamile Villafuerte Florida Atlantic University Advisor: Eduardo B. Fernandez

Agenda Methodology Overview Extending the methodology to distributed applications Financial Institution Example Conclusions

Methodology Overview Security principles must be applied at every development stage: Requirements: List of all possible attacks. Deduce policies to mitigate attacks. Analysis: Analysis patterns with predefined authorizations based on roles. Design: Interfaces can be used to enforce authorizations. Distribution provides another dimension where security restrictions can be applied.

Extending the Methodology Choices at the design stage for distributed applications: Requirements Analysis Design Implementation Centralized Distributed Web Services Remote Objects Fixed Network Wireless Network

Extending the Methodology How can we keep consistency of the security constraints across all development stages? How can we represent security constraints in the lower levels? What are the implications of wireless devices in our design models? Representation using UML deployment diagrams

Wireless Devices Challenges Limitations: Limited power Limited communications bandwidth Limited processing power Relatively unreliable network connection Mobile Tend to get destroyed accidentally or maliciously Have effect on security

Mapping I Fixed Networks Wireless Networks UML Application <?xml version=”1.0” ?> -<Customer = “Info”> <name>Juan</name> </Customer> Web Services SAML, XML Encryption, XML Signature, XKMS, WS-Security CORBA Security, Sec. Broker, Dist. Objects UML Application XML Application Distribution Security Constraints WS Security Dist. Objects Security C1 C2 WS1 WS2 O1 O2 XACML (u1,op1,c1) SAML WS-Policy Simplified Standards

Mapping II XACML will allow us to express the security constraints defined in the conceptual model in XML Simplified versions of security standards.

Authorization rule using XACML "Permit manager to open account." There is a lot of XML notation there, but essentially the rule permits a specific subject, to perform a specific action against a specific resource.

A Financial Institution Example Use Case Diagram

Analysis Model with RBAC Authorization

Design Model

Correspondence of Rights Rights defined for Customer (subject) Views and wireless devices received a subset of these rights. Example: Wireless device can not download a complete list of transactions (limited number of records), but can read balance.

Correspondence of Rights

Conclusions and future work We presented some ideas of how to map applications and security constraints defined in the analysis stage. More work needs to be done to elaborate simplified versions of the security standards for web services and to map distribution and hardware.