Security Contracts a Property-Based Approach to Support Security Patterns

Sylvain Guérin, Joel Champeau, Salvador Martínez, Raul Mazo

2024

Abstract

Security patterns represent reusable solutions and best practices intended to avoid security-related flaws in software and system designs. Unfortunately, the implementation and enforcement of these patterns remains a complex and error-prone task. As a consequence, and besides implementing a given security pattern, applications often remain insecure w.r.t. the security risk they intended to tackle. This is so for two main reasons: 1) patterns are rarely re-usable without adaptation, and thus concrete implementations may fail to deal with a number of (often implicit) properties, which must hold in order for the pattern to be effective; 2) patterns are deployed in environments with uncertainties that can only be known at runtime. In order to deal with this problem, we propose here Security Contracts, a framework that permits the specification and runtime monitoring of security patterns and related properties (including temporal ones) in both new and existing applications. It is based on an extension of the Design-by-Contract paradigm to enable the specification of security patterns and the runtime adaptation of applications. We demonstrate the feasibility of our approach with an implementation and its evaluation on a framework used worldwide in web technologies, Spring.

Paper Citation

in Harvard Style

Guérin S., Champeau J., Martínez S. and Mazo R. (2024). Security Contracts a Property-Based Approach to Support Security Patterns. In Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP; ISBN 978-989-758-683-5, SciTePress, pages 103-111. DOI: 10.5220/0012305600003648

in Bibtex Style

@conference{icissp24,
author={Sylvain Guérin and Joel Champeau and Salvador Martínez and Raul Mazo},
title={Security Contracts a Property-Based Approach to Support Security Patterns},
booktitle={Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP},
year={2024},
pages={103-111},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012305600003648},
isbn={978-989-758-683-5},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP
TI - Security Contracts a Property-Based Approach to Support Security Patterns
SN - 978-989-758-683-5
AU - Guérin S.
AU - Champeau J.
AU - Martínez S.
AU - Mazo R.
PY - 2024
SP - 103
EP - 111
DO - 10.5220/0012305600003648
PB - SciTePress