Towards Higher Assurance Software Construction via Aspects Thomas Llansó, Inventor

Background Software is ever more complex –Determining correctness very challenging What about software security functions? –Are they correct and properly integrated? –Often we hire independent labs to find out Employ an evaluation process (e.g., “Common Criteria”) Can be slow and costly (>6 months, >$100k)

Roots of the Problem Painful Integration –Security code… cuts across systems mixed in with application code hard to evolve over time –Integration via non-specialists Painful Evaluation –Manual, slow tracing –Extra scrutiny due to pedigree –Repeat as system evolves

What we want 1.improved security 2.easier integration What if we had a tool that could... –Automatically integrate security code –Enforce separation of duties –Allow automated tracing 3. faster evaluations 4. lower costs …even as software changes over time? requirements ↔ security code ↔ application code

Underlying Technology Key technologies/techniques in tool –Requirements Taxonomy –Aspects (from Aspect-Oriented programming) –Marker Annotations –XML for mappings / representation

Tool (“SRTD”)

Technology Applications Many stakeholders may find use for the tool StakeholderApplication Security DevelopersBuild and map security code Application DevelopersVerify mapping correctness Test PersonnelVerify code meets requirements System EvaluatorsRequirements ↔ Code tracing

Commercial Opportunities For technical information contact: Thomas Llanso, Inventor For licensing information contact: Norma Lee Todd, Technology Manager Office of Technology Transfer The Johns Hopkins University Applied Physics Laboratory Johns Hopkins Road Laurel, MD