skip to main content
10.1145/3510547.3517923acmconferencesArticle/Chapter ViewAbstractPublication PagescodaspyConference Proceedingsconference-collections
research-article

SecureWeaver: Intent-Driven Secure System Designer

Published: 28 April 2022 Publication History

Abstract

Design and management of networked systems, such as Information Technology/Network (IT/NW) or IoT systems, are inherently complex. Moreover, the need to adhere to security requirements adds even more complexity, as the manual audit and security mitigation of system design are time, skill, and labour intensive. In this paper, we present SecureWeaver, a secure system designer that generates a system design which meets functional, quantitative and security service requirements. SecureWeaver is based on the intent-based designer for IT/NW services named Weaver, and security support was implemented by improving the Weaver design stage via a threat mitigation knowledge base, specific refinement rules, and a security verification mechanism. A case study on video surveillance service requirements is used to illustrate the security threats and their mitigation during the automatic design process. Our results show that SecureWeaver is able to mitigate and verify the solutions from a security perspective without incurring a significant overhead: in our experiments, average overhead is 0.04% for systems with more than 100 elements. We also present a feature comparison with three other related systems that emphasizes the practical advantages of SecureWeaver.

Supplementary Material

MP4 File (SaT-CPS22-satfp10.mp4)
Design and management of networked systems, such as Information Technology/Network (IT/NW) or IoT systems, are inherently complex. Moreover, the need to adhere to security requirements adds even more complexity, as the manual audit and security mitigation of system design are time, skill, and labour intensive. We present SecureWeaver, a secure system designer that generates a system design which meets functional, quantitative and security service requirements. SecureWeaver is based on the intent-based designer, Weaver, and security support was implemented by improving the Weaver design stage via a threat mitigation knowledge base, specific refinement rules, and a security verification mechanism. A case study on video surveillance service requirements is used to illustrate the security threats and their mitigation during the automatic design process. Our results show that SecureWeaver is able to mitigate and verify the solutions from a security perspective without incurring a significant overhead.

References

[1]
Flora Amato, Nicola Mazzocca, and Francesco Moscato. 2018. Model driven design and evaluation of security level in orchestrated cloud services. Journal of Network and Computer Applications 106 (2018), 78--89.
[2]
James DesLauriers, Tamas Kiss, Gabriele Pierantoni, Gregoire Gesmier, and Gabor Terstyanszky. 2021. Enabling modular design of an application-level auto-scaling and orchestration framework using tosca-based application description templates. In 11th International Workshop on Science Gateways, IWSG 2019. CEURWorkshop Proceedings.
[3]
Charafeddine El Houssaini, Mahmoud Nassar, and Abdelaziz Kriouile. 2015. A cloud service template for enabling accurate cloud adoption and migration. In 2015 International Conference on Cloud Technologies and Applications (CloudTech). IEEE, 1--6.
[4]
Lukas Gressl, Christian Steger, and Ulrich Neffe. 2021. Design Space Exploration for Secure IoT Devices and Cyber-Physical Systems. ACM Transactions on Embedded Computing Systems (TECS) 20, 4 (2021), 1--24.
[5]
S Hernan, S Lambert, T Ostwald, and A Shostack. 2006. Uncover Security Design Flaws Using The STRIDE Approach.
[6]
Arthur S Jacobs, Ricardo J Pfitscher, Rafael H Ribeiro, Ronaldo A Ferreira, Lisandro Z Granville, Walter Willinger, and Sanjay G Rao. 2021. Hey, Lumi! Using Natural Language for {Intent-Based} Network Management. In 2021 USENIX Annual Technical Conference (USENIX ATC 21). 625--639.
[7]
Peter E Kaloroumakis and Michael J Smith. 2021. Toward a Knowledge Graph of Cybersecurity Countermeasures. Technical Report. Technical report.
[8]
Eunsuk Kang. 2016. Design space exploration for security. In 2016 IEEE Cybersecurity Development (SecDev). IEEE, 30--36.
[9]
Jinyong Kim, Eunsoo Kim, Jinhyuk Yang, Jaehoon Jeong, Hyoungshick Kim, Sangwon Hyun, Hyunsik Yang, Jaewook Oh, Younghan Kim, Susan Hares, et al. 2020. IBCS: intent-based cloud Services for Security Applications. IEEE Communications Magazine 58, 4 (2020), 45--51.
[10]
Takayuki Kuroda, Takuya Kuwahara, Takashi Maruyama, Kozo Satoda, Hideyuki Shimonishi, Takao Osaki, and Katsushi Matsuda. 2019. Weaver: A Novel Configuration Designer for IT/NW Services in Heterogeneous Environments. In 2019 IEEE Global Communications Conference (GLOBECOM). IEEE, 1--6.
[11]
Takuya Kuwahara, Takayuki Kuroda, Takao Osaki, and Kozo Satoda. 2021. An intent-based system configuration design for IT/NW services with functional and quantitative constraints. IEICE Transactions on Communications E104.B, 7 (2021), 791--804.
[12]
Lockheed Martin. 2014. Cyber kill chain. http://cyber.lockheedmartin.com/ hubfs/GainingtheAdvantageCyberKillChain.pdf
[13]
Nicolae Paladi, Antonis Michalas, and Hai-Van Dang. 2018. Towards secure cloud orchestration for multi-cloud deployments. In Proceedings of the 5th Workshop on CrossCloud Infrastructures & Platforms. 1--6.
[14]
Minh Pham and Doan B Hoang. 2016. SDN applications-The intent-based Northbound Interface realisation for extended applications. In 2016 IEEE NetSoft Conference and Workshops (NetSoft). IEEE, 372--377.
[15]
Andy D Pimentel. 2020. A case for security-aware design-space exploration of embedded systems. Journal of Low Power Electronics and Applications 10, 3 (2020), 22.
[16]
Adeel Rafiq, Asif Mehmood, Talha Ahmed Khan, Khizar Abbas, Muhammad Afaq, and Wang-Cheol Song. 2020. Intent-based end-to-end network service orchestration system for multi-platforms. Sustainability 12, 7 (2020), 2782.
[17]
Matt Rutkowski, CN Chris Lauwers, and C Curescu. 2020. TOSCA Simple Profile in YAML Version 1.3. https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile- YAML/v1.3/TOSCA-Simple-Profile-YAML-v1.3.pdf
[18]
Eder J Scheid, Cristian C Machado, Muriel F Franco, Ricardo L dos Santos, Ricardo P Pfitscher, Alberto E Schaeffer-Filho, and Lisandro Z Granville. 2017. INSpIRE: Integrated NFV-based intent refinement environment. In 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM). IEEE, 186--194.
[19]
BE Strom, A Applebaum, DP Miller, KC Nickels, AG Pennington, and CB Thomas. 2018. MITRE ATT&CK: Design and Philosophy. The Mitre Corporation, McLean. Technical Report. VA, Technical report.
[20]
Chao Wu, Shingo Horiuchi, Kenji Murase, Hiroaki Kikushima, and Kenichi Tayama. 2021. Intent-driven cloud resource design framework to meet cloud performance requirements and its application to a cloud-sensor system. Journal of Cloud Computing 10, 1 (2021), 1--22.

Cited By

View all
  • (2024)Robust by design: Designing ICT infrastructures using TwinsDigital Twins and Applications10.1049/dgt2.12018Online publication date: 29-Nov-2024
  • (2024)Cybersecurity for tactical 6G networks: Threats, architecture, and intelligenceFuture Generation Computer Systems10.1016/j.future.2024.107500(107500)Online publication date: Aug-2024
  • (2023)Automation for Network Security Configuration: State of the Art and Research TrendsACM Computing Surveys10.1145/361640156:3(1-37)Online publication date: 5-Oct-2023
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
Sat-CPS '22: Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems
April 2022
124 pages
ISBN:9781450392297
DOI:10.1145/3510547
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 28 April 2022

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. automated design
  2. design space exploration
  3. mitre att&ck
  4. networked system
  5. secure system design

Qualifiers

  • Research-article

Conference

CODASPY '22
Sponsor:

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)19
  • Downloads (Last 6 weeks)1
Reflects downloads up to 03 Mar 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Robust by design: Designing ICT infrastructures using TwinsDigital Twins and Applications10.1049/dgt2.12018Online publication date: 29-Nov-2024
  • (2024)Cybersecurity for tactical 6G networks: Threats, architecture, and intelligenceFuture Generation Computer Systems10.1016/j.future.2024.107500(107500)Online publication date: Aug-2024
  • (2023)Automation for Network Security Configuration: State of the Art and Research TrendsACM Computing Surveys10.1145/361640156:3(1-37)Online publication date: 5-Oct-2023
  • (2023)Merging FMEA and Digital Twins to Improve Trustfulness2023 7th International Conference on System Reliability and Safety (ICSRS)10.1109/ICSRS59833.2023.10381282(1-7)Online publication date: 22-Nov-2023
  • (2023)Security in Intent-Based Networking: Challenges and Solutions2023 IEEE Conference on Standards for Communications and Networking (CSCN)10.1109/CSCN60443.2023.10453125(296-301)Online publication date: 6-Nov-2023

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media