Towards Higher Assurance Software Construction via Aspects

Thomas Llansó, Inventor

Background

• Software is ever more complex– Determining correctness very challenging

• What about software security functions?– Are they correct and properly integrated?

– Often we hire independent labs to find out• Employ an evaluation process (e.g., “Common Criteria”)

• Can be slow and costly (>6 months, >$100k)

Roots of the Problem

• Painful Integration–Security code…

• cuts across systems• mixed in with application code• hard to evolve over time

–Integration via non-specialists

• Painful Evaluation–Manual, slow tracing–Extra scrutiny due to pedigree–Repeat as system evolves

• What we want1. improved security2. easier integration

• What if we had a tool that could...– Automatically integrate security code– Enforce separation of duties– Allow automated tracing

3. faster evaluations4. lower costs

…even as software changes over time?

requirements ↔ security code ↔ application code

Underlying TechnologyKey technologies/techniques in tool

– Requirements Taxonomy

– Aspects (from Aspect-Oriented programming)

– Marker Annotations

– XML for mappings / representation

Tool (“SRTD”)

Technology Applications• Many stakeholders may find use for the tool

Stakeholder ApplicationSecurity Developers Build and map security code

Application Developers Verify mapping correctness

Test Personnel Verify code meets requirements

System Evaluators Requirements ↔ Code tracing

Commercial Opportunities• For technical information contact:

Thomas Llanso, Inventor443-778-6343thomas.llanso@jhuapl.edu

• For licensing information contact:

Norma Lee Todd, Technology ManagerOffice of Technology TransferThe Johns Hopkins UniversityApplied Physics Laboratory11100 Johns Hopkins RoadLaurel, MD 20723443-778-4528norma.todd@jhuapl.eduwww.jhuapl.edu/ott