Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

From secure business process modeling to design-level security verification

: Ramadan, Q.; Salnitriy, M.; Strüber, D.; Jürjens, J.; Giorgini, P.


Batory, D. ; Institute of Electrical and Electronics Engineers -IEEE-; Association for Computing Machinery -ACM-:
ACM/IEEE 20th International Conference on Model Driven Engineering Languages and Systems, MODELS 2017. Proceedings : 17-22 September 2017, Austin, Texas
Piscataway, NJ: IEEE, 2017
ISBN: 978-1-5386-3493-6
ISBN: 978-1-5386-3492-9
International Conference on Model Driven Engineering Languages and Systems (MODELS) <20, 2017, Austin/Tex.>
Fraunhofer ISST ()

Tracing and integrating security requirements throughout the development process is a key challenge in security engineering. In socio-technical systems, security requirements for the organizational and technical aspects of a system are currently dealt with separately, giving rise to substantial misconceptions and errors. In this paper, we present a model-based security engineering framework for supporting the system design on the organizational and technical level. The key idea is to allow the involved experts to specify security requirements in the languages they are familiar with: business analysts use BPMN for procedural system descriptions; system developers use UML to design and implement the system architecture. Security requirements are captured via the language extensions SecBPMN2 and UMLsec. We provide a model transformation to bridge the conceptual gap between SecBPMN2 and UMLsec. Using UMLsec policies, various security properties of the resulting architecture can be verified. In a case study featuring an air traffic management system, we show how our framework can be practically applied.