A Tool-Supported Method for the Design and Implementation of Secure Distributed Applications

  • Linda Ariani Gunawan
  • Frank Alexander Kraemer
  • Peter Herrmann
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6542)


We describe a highly automated and tool-supported method for the correct integration of security mechanisms into distributed applications. Security functions to establish and release secure connections are provided as self-contained, collaborative building blocks specifying the behavior of several parties. For the security mechanisms to be effective, the application-specific model needs to fulfill certain behavioral properties, for instance, a consistent start and termination. We identify these properties and show how they lead to correct secured applications.


Shared Secret Security Mechanism Security Goal Common Object Request Broker Architecture Security Function 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Mouratidis, H., Giorgini, P.: Integrating Security and Software Engineering: Advances and Future Vision. IGI Global (2006)Google Scholar
  2. 2.
    Anderson, R.J.: Security Engineering: A Guide to Building Dependable Distributed Systems. John Wiley & Sons, Inc., Chichester (2008)Google Scholar
  3. 3.
    Lampson, B.W.: Computer Security in the Real World. Computer 37, 37–46 (2004)CrossRefGoogle Scholar
  4. 4.
    Rescorla, E.: SSL and TLS: Designing and Building Secure Systems. Addison-Wesley, Reading (2001)Google Scholar
  5. 5.
    Dierks, T., Rescorla, E.: The Transport Layer Security Protocol (TLS) version 1.2. The Internet Engineering Task Force (IETF), RFC 5246 (August 2008)Google Scholar
  6. 6.
    Georg, G., Ray, I., Anastasakis, K., Bordbar, B., Toahchoodee, M., Houmb, S.H.: An Aspect-Oriented Methodology for Designing Secure Applications. Information and Software Technology, Special Issue: Model-Driven Development for Secure Information Systems 51(5), 846–864 (2009)CrossRefGoogle Scholar
  7. 7.
    Mouheb, D., Talhi, C., Lima, V., Debbabi, M., Wang, L., Pourzandi, M.: Weaving security aspects into uml 2.0 design models. In: Proceedings of the 13th Workshop on Aspect-Oriented Modeling, AOM 2009, pp. 7–12. ACM, New York (2009)CrossRefGoogle Scholar
  8. 8.
    Kraemer, F.A.: Engineering Reactive Systems: A Compositional and Model-Driven Method Based on Collaborative Building Blocks. PhD thesis, Norwegian University of Science and Technology (August 2008)Google Scholar
  9. 9.
    Kraemer, F.A., Slåtten, V., Herrmann, P.: Tool Support for the Rapid Composition, Analysis and Implementation of Reactive Services. Journal of Systems and Software 82(12), 2068–2080 (2009)CrossRefGoogle Scholar
  10. 10.
    Kraemer, F.A., Herrmann, P.: Automated Encapsulation of UML Activities for Incremental Development and Verification. In: Schürr, A., Selic, B. (eds.) MODELS 2009. LNCS, vol. 5795, pp. 571–585. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  11. 11.
  12. 12.
    Kraemer, F.A., Herrmann, P.: Reactive Semantics for Distributed UML Activities. In: Hatcliff, J., Zucca, E. (eds.) FMOODS 2010. LNCS, vol. 6117, pp. 17–31. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  13. 13.
    Datta, A., Derek, A., Mitchell, J.C., Pavlovic, D.: Secure Protocol Composition. In: Proceedings of the 2003 ACM Workshop on Formal Methods in Security Engineering, FMSE 2003, pp. 11–23. ACM, New York (2003)CrossRefGoogle Scholar
  14. 14.
    Krawczyk, H.: The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?). In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 310–331. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  15. 15.
    Cremers, C.: Compositionality of Security Protocols: A Research Agenda. Electronic Notes Theoretical Computer Science 142, 99–110 (2006)CrossRefGoogle Scholar
  16. 16.
    Baskerville, R.: Information Systems Security Design Methods: Implications for Information Systems Development. ACM Computing Surveys 25(4), 375–414 (1993)CrossRefGoogle Scholar
  17. 17.
    Kraemer, F.A., Herrmann, P.: Transforming Collaborative Service Specifications into Efficiently Executable State Machines. In: Proceedings of the 6th International Workshop on Graph Transformation and Visual Modeling Techniques (GT-VMT 2007). Electronic Communications of the EASST, vol. 7. EASST (2007)Google Scholar
  18. 18.
    Kraemer, F.A., Herrmann, P., Bræk, R.: Aligning UML 2.0 State Machines and Temporal Logic for the Efficient Execution of Services. In: Meersman, R., Tari, Z. (eds.) OTM 2006. LNCS, vol. 4276, pp. 1613–1632. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  19. 19.
  20. 20.
  21. 21.
    Object Management Group: Common Object Request Broker Architecture (CORBA/IIOP), version 3.1, formal/2008-01-08 (January 2008)Google Scholar
  22. 22.
    Li, N., Mitchell, J.C., Tong, D.: Securing Java RMI-Based Distributed Applications. In: Proceedings of the 20th Annual Computer Security Applications Conference, ACSAC 2004, pp. 262–271. IEEE Computer Society, Los Alamitos (2004)Google Scholar
  23. 23.
    Object Management Group: CORBA Security Service, version 1.8, formal/2002-03-11 (March 2002)Google Scholar
  24. 24.
    OASIS: Web Services Security, version 1.1 (February 2006)Google Scholar
  25. 25.
    Jürjens, J.: Secure System Development with UML. Springer, Heidelberg (2004)zbMATHGoogle Scholar
  26. 26.
    Basin, D., Doser, J., Lodderstedt, T.: Model Driven Security: From UML Models to Access Control Infrastructures. ACM Transactions on Software Engineering and Methodology 15(1), 39–91 (2006)CrossRefGoogle Scholar
  27. 27.
    Pavlich-Mariscal, J., Michel, L., Demurjian, S.: Enhancing UML to Model Custom Security Aspects. In: Proceedings of the 11th Workshop on Aspect-Oriented Modeling, AOM 2007 (2007)Google Scholar
  28. 28.
    Schumacher, M., Fernandez-Buglioni, E., Hybertson, D., Buschmann, F., Sommerlad: Security Patterns: Integrating Security and Systems Engineering. Wiley Software Patterns Series. John Wiley & Sons, Chichester (2006)Google Scholar
  29. 29.
    Cremers, C.J.: The Scyther Tool: Verification, Falsification, and Analysis of Security Protocols. In: Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 414–418. Springer, Heidelberg (2008)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Linda Ariani Gunawan
    • 1
  • Frank Alexander Kraemer
    • 1
  • Peter Herrmann
    • 1
  1. 1.Department of TelematicsNorwegian University of Science and Technology (NTNU)TrondheimNorway

Personalised recommendations