Application of Contract-based Security Assertion Monitoring Framework for Telecommunications Software Engineering

Abstract : Telecommunication software systems, containing security vulnerabilities, continue to be created and released to consumers. We need to adopt improved software engineering practices to reduce the security vulnerabilities in modern systems. Contracts can provide a useful mechanism for the identification, tracking, and validation of security vulnerabilities. In this work, we propose a new contract-based security assertion monitoring framework (CB_SAMF) that is intended to reduce the number of security vulnerabilities that are exploitable across multiple software layers, and to be used in an enhanced systems development life cycle (SDLC). We show how contract-based security assertion monitoring can be achieved in a live environment on Linux. Through security activities integrated into the SDLC we can identify potential security vulnerabilities in telecommunication systems, which in turn are used for the creation of contracts defining security assertions. Our contract model is then applied, as runtime probes, against two common security related vulnerabilities in the form of a buffer overflow and a denial of service.
Type de document :
Article dans une revue
Mathematical and Computer Modelling, Elsevier, 2011, 53, pp.522--537
Liste complète des métadonnées

https://hal.inria.fr/inria-00550579
Contributeur : Isabelle Simplot-Ryl <>
Soumis le : mardi 28 décembre 2010 - 20:33:17
Dernière modification le : jeudi 11 janvier 2018 - 06:22:13

Identifiants

  • HAL Id : inria-00550579, version 1

Collections

Citation

Alexander Hoole, Issa Traoré, Isabelle Simplot-Ryl. Application of Contract-based Security Assertion Monitoring Framework for Telecommunications Software Engineering. Mathematical and Computer Modelling, Elsevier, 2011, 53, pp.522--537. 〈inria-00550579〉

Partager

Métriques

Consultations de la notice

88