Thomas Bleier, Zhendong Ma, Christian Wagner AIT Austrian Insitute of Technology

Transcription

1 Thomas Bleier, Zhendong Ma, Christian Wagner AIT Austrian Insitute of Technology 3 rd International Workshop Modeling Methods in Motion, Vienna, September 13 th, 2012

2 Outline ICT Security AIT Introduction Austrian egovenment System (PVP) Security Modeling of PVP Application Model-driven Security Development Lifecycle Summary

3 ICT Security AIT Basic Secure System Design Model-driven Security Safety & Security co-design Methodologies and Tools for Secure System Design SOA Cloud Computing Smart Grid Cyber Defense Critical Infrastrucutre Within framework of 4 national, 4 EU FP7, 1 ESA contracted security research projects

4 Motivation bmlvs.gv.at bmlvs.gv.at E-Government

5 Austrian egovernment System (PVP) Connecting 5 ministries 7 federal states 8 organisations 3 cities

6 MoSeS4eGov How to efficiently develop secure egovenment applications? 6

7 Model-driven approach Developer Models ADOxx Model Repository Serapis PVP conformed Web service 7

8 Modeling Method Security Engineering Model Driven Security Model Driven Architecture Software engineer Secure Web service Semantic loss Formal correctness Build-in semantics Specification of models Flexibility in use Information Constrains Semantics System Developer Meta Models 8

9 Modeling Language Specification Framework modelling method used for modelling procedure used in Mechanisms & Algorithms defines visualisation modelling Modelling language Language definiert Grammatik Notation notation visualises Syntax syntax defines way of language application defines meaning describes meaning of semantics Semantics modelling procedure steps delivers results generic mechanisms & algorithms specific mechanisms & algorithms considers connects semantic Semantic mapping Mapping arranges according to semantic Semantic domain Schema hybrid mechanisms & algorithms Karagiannis, D., Kühn, H.: Metamodelling Platforms. In Bauknecht, K., Min Tjoa, A., Quirchmayer, G. (Eds.): Proceedings of the Third International Conference EC-Web 2002 Dexa 2002, Aix-en-Provence, France, September 2002, LNCS 2455, Springer, Berlin/Heidelberg, p. 182 ff. 9

10 Meta Model Design Access Control Security Requirements Work Profile Business Process Web Services PVP

11 Use Case: Flood Rescue Mission 11

12 MoSeS4eGov Can we generalise our approach and model security at a higher level of abstraction? 12

13 What do we need? Model Stack Persons and Roles Responsibilities Tools Pool Document Pool Access Control Software Requirements Project Environment (1) Software Requirements (2a) System & Threats (2b) Security Requirements (3) Data Flow Diagram Security Requirements 13

14 Revisit Modeling Language Specification Framework modelling method used for modelling procedure used in Mechanisms & Algorithms defines visualisation modelling Modelling language Language definiert Grammatik Notation notation visualises Syntax syntax defines way of language application defines meaning describes meaning of semantics Semantics modelling procedure steps delivers results generic mechanisms & algorithms specific mechanisms & algorithms considers connects semantic Semantic mapping Mapping arranges according to semantic Semantic domain Schema hybrid mechanisms & algorithms Karagiannis, D., Kühn, H.: Metamodelling Platforms. In Bauknecht, K., Min Tjoa, A., Quirchmayer, G. (Eds.): Proceedings of the Third International Conference EC-Web 2002 Dexa 2002, Aix-en-Provence, France, September 2002, LNCS 2455, Springer, Berlin/Heidelberg, p. 182 ff. 14

15 Security Development Lifecycle Security & Privacy Practice Microsoft Security Development Lifecycle ( 15

16 Model-Driven Security Development Lifecycle (MDSDL) Meta Models Functionality Help files 16

17 Open Model Initiative 17

18 Summary MDS increases efficiency and simplicity in developing egovernment Web services For access control / role definition In PVP specific envireonment Security features predefined in the development System-specific, cost-benefit consideration Gaps in model processing, and model transformation Futher development of MDSDL 18

19 AIT Austrian Institute of Technology your ingenious partner Thomas Bleier, Zhendong Ma, Christian Wagner Contact: