Grant: Collaborative Research and Development Grants

In the coming years, information technology will continue to transform the way we think, work, communicate, and learn. The tremendous success of Internet-related technologies (web services, voice over IP, mobile telephony, etc.) coupled with advances both in hardware and software will invigorate the existing proliferation of software intensive systems. This will allow for new services, applications and systems that will recede increasingly into the background of our lives. In this setting, the secure engineering of such software-intensive systems becomes a major concern. This is emphasized by the fact that security breaches of software systems keep appearing at an alarming rate in spite of numerous updates and patches that are constantly being issued. The primary intent of this research is to contribute to the secure engineering of software-intensive systems. To this end, we envision extending current Model Driven Architecture (MDA) paradigms and prominent modern modeling languages, such as the Unified Modeling Language (UML), in order to address security concerns throughout the development lifecycle. This choice is motivated by the wide acceptance of these methods in industry and academia due to their expressiveness, easiness and tool support. In this research, the targeted security concerns are: capturing security requirements, specification and design of security mechanisms, verification and validation of security properties/policies, and automatic generation of secure code. Appropriate security profiles and UML language extensions will be used in the capture of security requirements as well as the specification and design of security solutions. For the purpose of verification and validation, we will automatically derive new semantic models from UML specifications and subject them to verification techniques against a-priori defined security policies. A significant objective of this research is to systematically generate secure code from the extended design models using aspect oriented programming techniques. Finally, we intend to leverage the obtained research results to the de facto language for system engineering i.e. System Modeling Language (SysML).