2026-07-20T10:41:56Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:859 2024-03-06T11:07:03Z ddc:004 open_access

A Framework for Analyzing Composition of Security Aspects Fox, Jorge Juerjens, Jan Aspects in software engineering aspect interference verification semantics formal methods The methodology of aspect-oriented software engineering has been proposed to factor out concerns that are orthogonal to the core functionality of a system. In particular, this is a useful approach to handling the difficulties of integrating non-functional requirements such as security into complex software systems. Doing so correctly and securely, however, still remains a non-trivial task. For example, one has to make sure that the "weaving" process actually enforces the aspects needed. This is highly non-obvious especially in the case of security, since different security aspects may actually contradict each other, in which case they cannot be woven in a sequential way without destroying each other. To address these problems, this paper introduces a framework for the aspect-oriented development of secure software using composition filters at the model level. Using an underlying foundation based on streamprocessing functions, we explore under which conditions security properties are preserved when composed as filters. Thanks to this foundation we may also rely on model level verification tools and on code and model weaving to remedy security failures. Our approach is explained using as case-studies a web banking application developed by a major German bank and a webstore design. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Jorge Fox and Jan Juerjens 2007 Is Part Of Dagstuhl Seminar Proceedings, Volume 6351, Methods for Modelling Software Systems (MMOSS) (2007) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/DagSemProc.06351.3 urn:nbn:de:0030-drops-8594 https://drops.dagstuhl.de/entities/document/10.4230/DagSemProc.06351.3 eng https://creativecommons.org/licenses/by/4.0/legalcode