Enhancing Security in Enterprise Distributed Real-time and Embedded Systems using Domain-specific Modeling Akshay Dabholkar, Joe Hoffert, Aniruddha Gokale, and Doug Schmidt March 20, 2007 Modeling CCM role-based access control (RBAC) rules and rights at design time Eliminates tedious and error-prone role-based checking at run-time Allows definition of platform-specific rights families like a PIM Allowing multilevel Security QoS provisioning through a configurable security policy framework Eliminates time consuming and inefficient runtime checks for consistency, conflicts, redundancy. Tailored to meet domain & application specific QoS requirements Providing fine-grained as well as coarse-grained access control and security guarantees Facilitates flexibility as well as customization Defining annotations for configuring security in component middleware Allows middleware configurations specific to the needs of different parts of a system Enables secure application deployment through middleware configuration Provisioning for defining Workflow/Business Process/Critical Path security Addressing Security via the Security Quality of Service (QoS) Modeling Language (SQML) Addressing Trust & Resiliency via the DDS Quality of Service (QoS) Modeling Language (DQML) Enhances trust by supporting correct-by-construction QoS configurations at design time Eliminates complex, tedious, and error-prone QoS compatibility and consistency checking at run- time or compile-time Provides separation of concerns to facilitate configuration analysis better Generates application artifacts (e.g., configuration files) Supports resiliency research by providing a base for higher level DDS resiliency services Model redundant replicas with desired properties in DQML Basis for DDS fault-tolerant service Data flows as intended via correct-by-construction QoS configurations (e.g., Power Grid ULS System) Durability- Volatile Durability- Transient Reliability- Reliable Reliability- Reliable Deadline- 10ms Deadline- 20ms Liveliness- Manual By Topic Liveliness- Automatic Nuclear Reactor Status Timebased- 5ms Nuclear Reactor Control Room Power Grid Control Room Power Substation Status Deadline- 10ms Deadline- 15ms Power Substation 1 Nuclear Reactor Deadline- 10ms Power Substation 2 Power Substation 3 Deadline- 15ms Reliability- Reliable Ongoing Research Creation of higher level DDS services built on DQML work Discovery and documentation of DDS patterns Creation of DDS fault-tolerance service (e.g., using ownership/ownership strength, durability policies, multiple readers and writers, hot-swap and failover DDS pattern) Creation of DDS real-time data service (e.g., using deadline, transport priority, latency budget policies, continuous data pattern) Generation of security mapping and security platform independent model (PIM) Map SQML’s RBAC onto DDS security service Develop security PIM with SQML and DQML security services as input Motivating Example: Ultra-Large Scale (ULS) Systems ULS systems require: Security – capability of the system to provide confidentiality, integrity, and availability on the ULS system data and services both locally and globally Trust – extent to which users of the ULS system will be able to rely on the data and services of the ULS system Resiliency – capability of the ULS system to maintain an acceptable level of service while under stress from adverse environmental conditions such as attacks or cascading failures National/International Power Grid Air Traffic Management Constellations of Satellites Homeland Defense Challenges for EDRE Middleware: End-to-end Security – security must be incorporated into all aspects and layers of the application Correctness – design of the application must be ensured when deployed Redundancy – backups of critical pieces of the application must be configured properly and take over when needed Durability- Volatile Durability- Transient Reliability- Reliable Reliability- Reliable Deadline- 10ms Deadline- 20ms Liveliness- Automatic Nuclear Reactor Status Nuclear Reactor Control Room Nuclear Reactor Timebased- 5ms Deadline- 10ms Liveliness- Manual By Topic Map SQML security onto DQML Security PIM SQML input to security PIM DQML input to security PIM Interface Security QoS Domain-Specific Security Policy Component Security QoS Conforms to Policy