Skip to main content
SpringerLink
Log in
SpringerLink
Log in

Identification of Security Requirements in Systems of Systems by Functional Security Analysis

  • Chapter
Architecting Dependable Systems VII

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 6420))

Abstract

Cooperating systems typically base decisions on information from their own components as well as on input from other systems. Safety critical decisions based on cooperative reasoning however raise severe concerns to security issues. Here, we address the security requirements elicitation step in the security engineering process for such systems of systems. The method comprises the tracing down of functional dependencies over system component boundaries right onto the origin of information as a functional flow graph. Based on this graph, we systematically deduce comprehensive sets of formally defined authenticity requirements for the given security and dependability objectives. The proposed method thereby avoids premature assumptions on the security architecture’s structure as well as the means by which it is realised. Furthermore, a tool-assisted approach that follows the presented methodology is described.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Avizienis, A., Laprie, J.C., Randell, B., Landwehr, C.E.: Basic concepts and taxonomy of dependable and secure computing. IEEE Trans. Dependable Sec. Comput. 1(1), 11–33 (2004)

    Article  Google Scholar 

  2. Bodeau, D.J.: System-of-Systems Security Engineering. In: Proc. of the 10th Annual Computer Security Applications Conference, Orlando, Florida, pp. 228–235. IEEE Computer Society, Los Alamitos (1994)

    Google Scholar 

  3. Eilenberg, S.: Automata, Languages and Machines, vol. A. Academic Press, New York (1974)

    MATH  Google Scholar 

  4. Firesmith, D.: Engineering security requirements. Journal of Object Technology 2(1), 53–68 (2003)

    Article  Google Scholar 

  5. Fuchs, A., Rieke, R.: Identification of authenticity requirements in systems of systems by functional security analysis. In: Proceedings of the 2009 IEEE/IFIP Conference on Dependable Systems and Networks Workshop on Architecting Dependable Systems (WADS 2009), Supplementary Volume (2009), http://sit.sit.fraunhofer.de/smv/publications/

  6. Giorgini, P., Massacci, F., Mylopoulos, J., Zannone, N.: Requirements engineering meets trust management: Model, methodology, and reasoning. In: Jensen, C., Poslad, S., Dimitrakos, T. (eds.) iTrust 2004. LNCS, vol. 2995, pp. 176–190. Springer, Heidelberg (2004)

    Google Scholar 

  7. Group, T.C.: TCG TPM Specification 1.2 revision 103 (2006), http://www.trustedcomputing.org

  8. Gürgens, S., Ochsenschläger, P., Rudolph, C.: Authenticity and provability - a formal framework. In: Davida, G.I., Frankel, Y., Rees, O. (eds.) InfraSec 2002. LNCS, vol. 2437, pp. 227–245. Springer, Heidelberg (2002)

    Chapter  Google Scholar 

  9. Haley, C.B., Laney, R.C., Moffett, J.D., Nuseibeh, B.: Security requirements engineering: A framework for representation and analysis. IEEE Trans. Software Eng. 34(1), 133–153 (2008)

    Article  Google Scholar 

  10. Hatebur, D., Heisel, M., Schmidt, H.: A security engineering process based on patterns. In: Proceedings of the International Workshop on Secure Systems Methodologies using Patterns (SPatterns), DEXA 2007, pp. 734–738. IEEE Computer Society, Los Alamitos (2007), http://www.ieee.org/

  11. Hatebur, D., Heisel, M., Schmidt, H.: A pattern system for security requirements engineering. In: Proceedings of the International Conference on Availability, Reliability and Security (AReS), pp. 356–365. IEEE, Los Alamitos (2007), http://www.ieee.org/

    Chapter  Google Scholar 

  12. Hatebur, D., Heisel, M., Schmidt, H.: Analysis and component-based realization of security requirements. In: Proceedings of the International Conference on Availability, Reliability and Security (AReS), pp. 195–203. IEEE Computer Society Press, Los Alamitos (2008), http://www.ieee.org/

    Chapter  Google Scholar 

  13. van Lamsweerde, A.: Elaborating security requirements by construction of intentional anti-models. In: Proceedings of the 26th International Conference on Software Engineering, ICSE 2004, pp. 148–157. IEEE Computer Society, Los Alamitos (2004)

    Chapter  Google Scholar 

  14. Liu, L., Yu, E., Mylopoulos, J.: Analyzing security requirements as relationships among strategic actors. In: 2nd Symposium on Requirements Engineering for Information Security, SREIS 2002 (2002)

    Google Scholar 

  15. Mead, N.R.: How To Compare the Security Quality Requirements Engineering (SQUARE) Method with Other Methods. Tech. Rep. CMU/SEI-2007-TN-021, Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA (2007)

    Google Scholar 

  16. Mead, N.R., Hough, E.D.: Security requirements engineering for software systems: Case studies in support of software engineering education. In: Proceedings of the 19th Conference on Software Engineering Education & Training, CSEET 2006, pp. 149–158. IEEE Computer Society, Washington (2006)

    Chapter  Google Scholar 

  17. Mellado, D., Fernández-Medina, E., Piattini, M.: A common criteria based security requirements engineering process for the development of secure information systems. Comput. Stand. Interfaces 29(2), 244–253 (2007)

    Article  Google Scholar 

  18. Ochsenschläger, P., Repp, J., Rieke, R.: Abstraction and composition – a verification method for co-operating systems. Journal of Experimental and Theoretical Artificial Intelligence 12, 447–459 (2000), http://sit.sit.fraunhofer.de/smv/publications/ ; copyright: ©2000, American Association for Artificial Intelligence, All rights reserved, http://www.aaai.org

    Google Scholar 

  19. Ochsenschläger, P., Rieke, R.: Abstraction based verification of a parameterised policy controlled system. In: International Conference “Mathematical Methods, Models and Architectures for Computer Networks Security” (MMM-ACNS-7). CCIS, vol. 1, Springer, Heidelberg (2007), http://sit.sit.fraunhofer.de/smv/publications/

    Google Scholar 

  20. Ochsenschläger, P., Repp, J., Rieke, R., Nitsche, U.: The SH-Verification Tool Abstraction-Based Verification of Co-operating Systems. Formal Aspects of Computing, The International Journal of Formal Method 11, 1–24 (1999)

    Google Scholar 

  21. Ochsenschläger, P., Rieke, R.: Uniform parameterisation of phase based cooperations. Tech. Rep. SIT-TR-2010/1, Fraunhofer SIT (2010), http://sit.sit.fraunhofer.de/smv/publications/

  22. Papadimitratos, P., Buttyan, L., Hubaux, J.P., Kargl, F., Kung, A., Raya, M.: Architecture for Secure and Private Vehicular Communications. In: IEEE International Conference on ITS Telecommunications (ITST), pp. 1–6. Sophia Antipolis, France (June 2007)

    Google Scholar 

  23. Ruddle, A., Ward, D., Weyl, B., Idrees, S., Roudier, Y., Friedewald, M., Leimbach, T., Fuchs, A., Grgens, S., Henniger, O., Rieke, R., Ritscher, M., Broberg, H., Apvrille, L., Pacalet, R., Pedroza, G.: Security requirements for automotive on-board networks based on dark-side scenarios. EVITA Deliverable D2.3, EVITA project (2009), http://evita-project.org/deliverables.html

  24. Sadeghi, A.R., Stüble, C.: Property-based attestation for computing platforms: caring about properties, not mechanisms. In: Proceedings of the 2004 Workshop on New Security Paradigms, NSPW 2004, pp. 67–77. ACM, New York (2004)

    Google Scholar 

  25. Sailer, R., Zhang, X., Jaeger, T., van Doorn, L.: Design and implementation of a TCG-based integrity measurement architecture. In: Proceedings of the 13th USENIX Security Symposium. USENIX Association (2004)

    Google Scholar 

  26. Schaub, F., Ma, Z., Kargl, F.: Privacy requirements in vehicular communication systems. In: IEEE International Conference on Privacy, Security, Risk, and Trust (PASSAT 2009), Symposium on Secure Computing (SecureCom 2009), Vancouver, Canada (August 2009), http://doi.ieeecomputersociety.org/10.1109/CSE.2009.135

  27. Shirey, R.: Internet Security Glossary, Version 2. RFC 4949 (Informational) (August 2007), http://www.ietf.org/rfc/rfc4949.txt

Download references

Author information

Authors and Affiliations

  1. Fraunhofer Institute for Secure Information Technology (SIT), Rheinstrasse 75, 64295, Darmstadt, Germany

    Andreas Fuchs & Roland Rieke

Authors
  1. Andreas Fuchs
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Roland Rieke
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Faculty of Science, University of Lisbon, Campo Grande, Bloco C6, Piso 3, 1749-016, Lisbon, Portugal

    Antonio Casimiro

  2. School of Computing, University of Kent, CT2 7NF, Canterbury, Kent, UK

    Rogério de Lemos

  3. Centre for Software Reliability, City University, London, Northampton Square, EC1V 0HB, London, UK

    Cristina Gacek

Rights and permissions

Reprints and permissions

Copyright information

© 2010 Springer-Verlag Berlin Heidelberg

About this chapter

Cite this chapter

Fuchs, A., Rieke, R. (2010). Identification of Security Requirements in Systems of Systems by Functional Security Analysis. In: Casimiro, A., de Lemos, R., Gacek, C. (eds) Architecting Dependable Systems VII. Lecture Notes in Computer Science, vol 6420. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-17245-8_4

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-17245-8_4

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-17244-1

  • Online ISBN: 978-3-642-17245-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation