Aspect-oriented modeling framework for security hardening

Abstract

Aspect-oriented modeling (AOM) emerged as a promising paradigm for handling crosscutting concerns, such as security, at the software modeling level. Most existing AOM contributions are presented from a practical perspective and lack formal syntax and semantics. In this paper, we present a practical and formal AOM framework for software security hardening. Our contributions are threefold. First, we define an AOM approach for the specification of security aspects at the unified modeling language (UML) design level. Second, we design and implement the matching and the weaving processes into UML design models. Third, we elaborate formal specifications for aspect matching and weaving in UML activity diagrams. Finally, we demonstrate the viability and the relevance of our propositions using a case study. The proposed framework is supported by a tool built on top of IBM-Rational Software Modeler.

Appendices

Appendix 1: Matching and weaving semantics

In this appendix, we present the matching and the weaving semantics in activity diagrams. The matching semantics describes how to identify the join points targeted by the activity adaptations, whereas the weaving semantics describes how to apply the activity adaptations at the identified join points.

1.1 Matching semantics

We define the judgment $\mathcal {A}, n \vdash _{\mathrm{match}} { pcd}$, which is used in the matching semantic rules, presented in Fig. 20, to describe that a node n belonging to the activity $\mathcal {A}$ matches the pointcut pcd. A node n can be an initial node i, an activity final node af, a flow final node ff, a fork node f, a join node j, a decision node d, a merge node m, an action node a, a call operation action node coa, a read structural feature action node ra, a write structural feature action node wa, a create object action node ca, a destroy object action node da, or either of these nodes sn. Before presenting the matching rules, we need to explain the notation of equality of type lists presented in Fig. 19, since it is used in the rule Args. Two lists of types are equal if the nth item in the first list is an instance of the nth item in the second list.

Fig. 19

Equality of type lists

Fig. 20

Matching Semantics

1.2 Weaving semantics

The weaving semantics is represented by the weaving configuration $\langle \textsf {Activity},\textsf {Aspect},\textsf {Node},\textsf {State}\rangle$ (Fig. 24). The state $\textsf {State}$ is a flag that represents the stage of the weaving process, which is either weaving or end. The flag is equal to weaving when adaptations still have to be woven, whereas it becomes end when  the  weaving  is  completed. Hence, the transformation ${\langle \mathcal {A},s,n,\mathtt{weaving}\rangle \hookrightarrow }$ ${ \langle \mathcal {A'},[~],n',\mathtt{end} \rangle }$ means that the activity diagram $\mathcal {A'}$ is the result of weaving all the applicable adaptations in the adaptation list s into the node n. A node whose  type  is  proceed  is  denoted pr, whereas the set {action, call, read, write, create, destroy} is called actionSet. Before presenting the weaving rules, we need to explain the following notation:

Fig. 21

Derivation of Proceed nodes

Fig. 22

Derivation of no Proceed nodes

Fig. 23

Substitution rules

• The axiom ${\Vdash n}$ defines that the node n is of type proceed or it is a structured activity node having, at least, one proceed node. Derivations of proceed nodes are shown in Fig. 21.

• The axiom ${\Vvdash n}$ defines that the node n is not of type proceed or it is a structured activity node that none of its nodes is of type proceed. Derivations of no proceed nodes are shown in Fig. 22.

• The representation $s'=s[n_{1}\rightarrow n_{2}]$ describes that the set $s'$ comes out as a result of substituting $n_{1}$ by $n_{2}$ wherever $n_{1}$ appears in the set s, as long as the nodes in the set s are not proceed structured activities. This is accompanied by modifying the incoming and the outgoing edges of the node $n_{2}$ together with modifying the corresponding edges’ sources and targets. In the case that a node in the set s is a proceed structured activity, we substitute $n_{1}$ by $n_{2}$ wherever $n_{1}$ appears in the nodes of this proceed structured activity. The substitution rules are shown in Fig. 23.

Fig. 24

Weaving semantics

Appendix 2: Completeness and correctness of the weaving

We state and prove results that establish the soundness and the completeness of the algorithms containProceed in Fig. 10, substitute in Fig. 11, $\mathcal {M}$ in Fig. 12, and $\mathcal {W}$ in Figs. 13 and 14 with respect to the semantics reported in Figs. 21, 23, 20, and 24. The following lemma states the soundness of the algorithm containProceed.

Lemma 1

(Soundness of containProceed). Given a node n. If containProceed then $\Vdash n$.

The following lemma states the completeness of the algorithm containProceed.

Lemma 2

(Completeness of containProceed). Given a node n. If $\Vdash n$ then containProceed .

The proofs of Lemmas 1 and 2 are straightforward since the algorithm containProceed results from the rules presented in Fig. 21.

The following lemma states the soundness of the algorithm substitute.

Lemma 3

(Soundness of substitute). Given   a  set  s  and two  nodes  $n_{1}$  and  $n_{2}$. If $\textsf {substitute}(s,n_{1},n_{2})=s'$ then $s'=s[n_{1}\rightarrow n_{2}]$.

The following lemma states the completeness of the algorithm substitute.

Lemma 4

(Completness of substitute). Given a set s and two nodes $n_{1}$ and $n_{2}$. If $s'=s[n_{1}\rightarrow n_{2}]$ then $\textsf {substitute}(s,n_{1},n_{2})=s'$.

The proofs of Lemmas 3 and 4 are straightforward since the algorithm substitute results from the rules presented in Fig. 23.

The following lemma states the soundness of the matching algorithm $\mathcal {M}$.

Lemma 5

(Soundness of $\mathcal {M}$). Given a set of activity diagrams $\mathcal {AS}$, an activity node n, and a pointcut pcd. If $\mathcal {M}(\mathcal {AS},n,{ pcd})$ where $\mathcal {A}\in \mathcal {AS}$ and $n\in \mathcal {A}.nodes$ then $\mathcal {A}, n \vdash _{\mathrm{match}} { pcd}$.

Proof

The proof of Lemma 5 is straightforward by case analysis. Let us take as example the following cases:

• Case (initial):

  From the algorithm $\mathcal {M}$, we have:

  

  Since $n.type =\mathtt{initial}$ then n is an initial node i.

  By the rule (Initial) of the matching rules presented in Fig. 20, we conclude:

  

• Case (call):

  From the algorithm $\mathcal {M}$, we have:

  

  Since $n.type =\mathtt{call}$ then n is a call operation action node (coa).

  By the rule (Call) of the matching rules presented in Fig. 20, we conclude:

  

• Case (read):

  From the algorithm $\mathcal {M}$, we have:

  

  Since $n.type =\mathtt{read}$ then n is a read structural feature action node (ra).

  By the rule (Read) of the matching rules presented in Fig. 20, we conclude:

  

• Case (write):

  From the algorithm $\mathcal {M}$, we have:

  

  Since $n.type =\mathtt{write}$ then n is a write structural feature action node (wa).

  By the rule (Write) of the matching rules presented in Fig. 20, we conclude:

  

• Case (inside_activity):

  From the algorithm $\mathcal {M}$, we have:

  

  Since $n.type =\mathtt{action}$ then n is a simple node (sn).

  By the rule (InsideActivity) of the matching rules presented in Fig. 20, we conclude:

  

$\square$

The following lemma states the completeness of the matching algorithm $\mathcal {M}$.

Lemma 6

(Completeness of $\mathcal {M}$). Given a set of activity diagrams $\mathcal {AS}$, an activity diagram $\mathcal {A}$ where $\mathcal {A}\in \mathcal {AS}$, an activity node n where $n \in \mathcal {A}.nodes$, and a pointcut pcd. If $\mathcal {A}, n \vdash _{\mathrm{match}} pcd$ then $\mathcal {M}(\mathcal {AS},n,pcd)$.

Proof

The proof of Lemma 6 is straightforward by propagating the matching rules, presented in Fig. 20, from conclusion to premises. Let us take as example the following case:

• Case (initial):

  From the rule (Initial), we have:

  

  Since n is an initial node i, then $n.type =\mathtt {initial}$.

  Since $\mathcal {A}\in \mathcal {AS}$ and $n \in \mathcal {A}.nodes$, by the algorithm $\mathcal {M}$ presented in Fig. 12, we conclude:

  

$\square$

The following theorem states the soundness of the weaving algorithm $\mathcal {W}$.

Theorem 1

(Soundness of $\mathcal {W}$). Given an activity diagram $\mathcal {A}$, an adaptation list s, and a node n. If $\mathcal {W}(\mathcal {A},s,n)$=$\mathcal {A''}$ then $\langle \mathcal {A},s, n,\mathtt{weaving} \rangle \hookrightarrow \langle \mathcal {A}'',[~],n'',\mathtt{end}\rangle$.

Proof

The proof is done by induction over the length of s.

• 1. Induction basis ($s=[~]$):

  By the algorithm $\mathcal {W}$, we have:

  

  From the algorithm $\mathcal {W}$, we conclude that $s=[~]$. From the rule (End) of the semantic weaving rules presented in Fig. 24, we conclude:

  

• 2. Induction step:

  We assume as induction hypothesis:

  If $\mathcal {W}(\mathcal {A},s',n)$=$\mathcal {A''}$ then $\langle \mathcal {A},s', n, \mathtt{weaving} \rangle \hookrightarrow \langle \mathcal {A}'',[~],n'',\mathtt{end}\rangle$.

  Now, let us consider ($s=ad::s'$). Since $ad.kind$ can be:

  • Case (add):

    Since $ad.pos$ can be:

    • Subcase (before):

      From the algorithm $\mathcal {W}$, we have:

      

      By the soundness of the algorithm $\mathcal {M}$, we conclude:

      

      From the rule (Before) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the hypothesis, we conclude:

      

      By the transitivity of $\hookrightarrow$, we conclude:

      

    • Subcase (after):

      From the algorithm $\mathcal {W}$, we have:

      

      By the soundness of the algorithm $\mathcal {M}$, we conclude:

      

      From the rule (After) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the hypothesis, we conclude:

      

      By the transitivity of $\hookrightarrow$, we conclude:

      

    • Subcase (around with proceed):

      From the algorithm $\mathcal {W}$, we have:

      

      By the soundness of the algorithm $\mathcal {M}$, we conclude:

      

      By the soundness of the algorithm containProceed, we conclude:

      

      By the soundness of the algorithm substitute, we conclude:

      

      From the rule (${\small \mathsf{AroundWProceed}}$) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the hypothesis, we conclude:

      

      By the transitivity of $\hookrightarrow$, we conclude:

      

    • Subcase (around without proceed):

      From the algorithm $\mathcal {W}$, we have:

      

      By the soundness of the algorithm $\mathcal {M}$, we conclude:

      

      By the soundness of the algorithm containProceed and the rules presented in Figs. 21 and 22, we conclude:

      

      By the soundness of the algorithm substitute, we conclude:

      

      From the rule (${\small \mathsf{AroundWoutProceed}}$) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the hypothesis, we conclude:

      

      By the transitivity of $\hookrightarrow$, we conclude:

      

  • Case (remove):

    From the algorithm $\mathcal {W}$, we have:

    

    By the soundness of the algorithm $\mathcal {M}$, we conclude:

    

    From the rule (Remove) of the semantic weaving rules presented in Fig. 24, we conclude:

    

    By the hypothesis, we conclude:

    

    By the transitivity of $\hookrightarrow$, we conclude:

    

  • Case (no match):

    By the soundness and the completeness of the algorithm $\mathcal {M}$, we conclude:

    

    From the rule (NoMatch) of the semantic weaving rules presented in Fig. 24, we conclude:

    

    By the hypothesis, we conclude:

    

    By the transitivity of $\hookrightarrow$, we conclude:

    

$\square$

The following theorem states the completeness of the weaving algorithm $\mathcal {W}$.

Theorem 2

(Completeness of $\mathcal {W}$). Given an activity diagram $\mathcal {A}$, an adaptation list s, and a node n.

If $\langle \mathcal {A},s, n,\mathtt{weaving} \rangle \hookrightarrow \langle \mathcal {A}'',[~],n'',\mathtt{end}\rangle$ then $\mathcal {W}(\mathcal {A},s,n)$=$\mathcal {A''}$.

Proof

The proof is done by induction over the length of s.

• 1. Induction basis ($s=[~]$):

  By the rule (End) of the semantic weaving rules presented in Fig. 24, we have:

  

  From the rule (End) of the semantic weaving rules presented in Fig. 24, we conclude that $s=[~]$.

  From the algorithm $\mathcal {W}$, we conclude:

  

• 2. Induction step:

  We assume as induction hypothesis:

  If $\langle \mathcal {A},s', n,\mathtt{weaving} \rangle \hookrightarrow \langle \mathcal {A}'',[~],n'',\mathtt{end}\rangle$ then $\mathcal {W}(\mathcal {A},s',n)$=$\mathcal {A''}$.

  Now, let us consider ($s=ad::s'$). Since $ad.kind$ can be:

  • Case (add):

    Since $ad.pos$ can be:

    • Subcase (before):

      From the rule (Before) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the completeness of the algorithm $\mathcal {M}$, we conclude:

      

      From the algorithm $\mathcal {W}$, we conclude:

      

      By the hypothesis, we conclude:

      

    • Subcase (after):

      From the rule (After) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the completeness of the algorithm $\mathcal {M}$, we conclude:

      

      From the algorithm $\mathcal {W}$, we conclude:

      

      By the hypothesis, we conclude:

      

    • Subcase (around with proceed):

      From the rule (AroundWProceed) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the completeness of the algorithm $\mathcal {M}$, we conclude:

      

      By the completeness of the algorithm containProceed, we conclude:

      

      By the completeness of the algorithm substitute, we conclude:

      

      From the algorithm $\mathcal {W}$, we conclude:

      

      By the hypothesis, we conclude:

      

    • Subcase (around without proceed):

      From the rule (AroundWouProceed) of the semantic weaving rules presented in Fig. 24, we conclude:

      

      By the completeness of the algorithm $\mathcal {M}$, we conclude:

      

      By the completeness of the algorithm containProceed, we conclude:

      

      By the completeness of the algorithm substitute, we conclude:

      

      From the algorithm $\mathcal {W}$, we conclude:

      

      By the hypothesis, we conclude:

      

  • Case (remove):

    From the rule (Remove) of the semantic weaving rules presented in Fig. 24, we conclude:

    

    By the completeness of the algorithm $\mathcal {M}$, we conclude:

    

    From the algorithm $\mathcal {W}$, we conclude:

    

    By the hypothesis, we conclude:

    

  • Case (no match):

    From the rule (NoMatch) of the semantic weaving rules presented in Fig. 24, we conclude:

    

    By the soundness and the completeness of the algorithm $\mathcal {M}$, we conclude:

    

    From the algorithm $\mathcal {W}$, we conclude:

    

    By the hypothesis, we conclude:

    

$\square$