Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

Nicolas Boltz, Sebastian Hahner, Christopher Gerking, Robert Heinrich

TL;DR

This paper presents an open and extensible framework for data flow analysis that is compatible with DFDs and can also extract data flows from the Palladio architectural description language and showcases the extensibility with multiple model and analysis extensions.

Abstract

The growing interconnection between software systems increases the need for security already at design time. Security-related properties like confidentiality are often analyzed based on data flow diagrams (DFDs). However, manually analyzing DFDs of large software systems is bothersome and error-prone, and adjusting an already deployed software is costly. Additionally, closed analysis ecosystems limit the reuse of modeled information and impede comprehensive statements about a system's security. In this paper, we present an open and extensible framework for data flow analysis. The central element of our framework is our new implementation of a well-validated data-flow-based analysis approach. The framework is compatible with DFDs and can also extract data flows from the Palladio architectural description language. We showcase the extensibility with multiple model and analysis extensions. Our evaluation indicates that we can analyze similar scenarios while achieving higher scalability compared to previous implementations.

An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

TL;DR

This paper presents an open and extensible framework for data flow analysis that is compatible with DFDs and can also extract data flows from the Palladio architectural description language and showcases the extensibility with multiple model and analysis extensions.

Abstract

The growing interconnection between software systems increases the need for security already at design time. Security-related properties like confidentiality are often analyzed based on data flow diagrams (DFDs). However, manually analyzing DFDs of large software systems is bothersome and error-prone, and adjusting an already deployed software is costly. Additionally, closed analysis ecosystems limit the reuse of modeled information and impede comprehensive statements about a system's security. In this paper, we present an open and extensible framework for data flow analysis. The central element of our framework is our new implementation of a well-validated data-flow-based analysis approach. The framework is compatible with DFDs and can also extract data flows from the Palladio architectural description language. We showcase the extensibility with multiple model and analysis extensions. Our evaluation indicates that we can analyze similar scenarios while achieving higher scalability compared to previous implementations.
Paper Structure (16 sections, 7 figures, 1 table)

This paper contains 16 sections, 7 figures, 1 table.

Table of Contents

  1. Introduction
  2. Overview of the Data Flow Analysis Framework
  3. Modeling and Deriving Data Flow Diagrams
  4. Unified Data Flow Diagram Metamodel
  5. Manually Defining Data Flow Diagrams
  6. Automatically Deriving Data Flows from Architectural Models
  7. Data Flow Analysis
  8. Architecture Overview
  9. Flow Graph Extraction
  10. Label Propagation
  11. DSL-based Constraint Checking
  12. Analysis Framework Extensions
  13. Evaluation
  14. Evaluation Design
  15. Evaluation Results
  16. ...and 1 more sections

Figures (7)

  • Figure 1: Informal overview of the structure of the data flow analysis framework.
  • Figure 2: Metamodel of data flow diagrams and data dictionaries.
  • Figure 3: Screenshot of the web-based editor showing the DFD of a simplified online shop.
  • Figure 4: Simplified PCM model of the online shop example and the corresponding data flow with annotated node labels, data labels, and numbered transformation traces.
  • Figure 5: Analysis architecture as performed key activities.
  • ...and 2 more figures