Abstract
After a brief boom in the 90’s with small companies and independent software developers, the IT industry is re-discovering the need for teams of programmers developing large software projects. These development teams to leverage the effort and make the software available for future projects use a component-based paradigm. Naturally, detailed specifications and APIs are necessary in order to utilize these components in future projects. These specifications are primarily aimed at describing the normal or functional behavior of the components, not the abnormal or security related features and flaws. This paper will investigate the fundamental issues related to building and composing secure components. The approach outlined in this paper develops a certification process for testing software components for security properties. The anticipated results from this paper are a process, set of core white-box and black-box testing technologies to certify the security of software component and a framework for constructing compositional Component Security Assurance (CSA) based on the security property exposed by the atomic components.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Stephenson, J.: Web Services Architectures for Security. CBDi Journal (February 2003), http://www.cbdiforum.com/
Aoyama, M.: New Age of Software Development: New Component-Based Software Engineering Changes the Way of Software Development. In: 1998 International Workshop on CBSE, ICSE, pp. 124–128 (1998)
CBSE98. Proceedings of International Workshop on Component-Based software Engineering, www.sei.cmu.edu/cbs/ics98/ , Kyoto Japan (April 1998)
Herzum, P., Sims, O.: Business Component Factory: A Comprehensive Overview of CBD for the Enterprise. OMG press (December 1999)
Szyperski, C.: Component Software: Beyond Object-Oriented Programming. Addison-Wesley, Reading (January 1998), http://www.sei.cmu.edu/cbs/icse98/papers/p14.htm
D’Souza, D.F., Wills, A.C.: Objects, Components, and FrameworksWith UML: The Catalysis Approach, Addison-Wesley Object (October 1998)
Common Criteria Project/ISO, Common Criteria for Information Technology Security Evaluation Version 2.1 (ISO/IEC 15408), http://www.commoncriteria.org/cc/ (1999)
Common Criteria Project/ISO. Common Criteria for Information Technology Security Evaluation, version 2.1(ISO/IEC International Standard 15408). NIST, USA and ISO, Switzerland, http://csrc.nist.gov/cc/ (December 1999)
Information Technology-Software Life cycle Process, (ISO/IEC 12207), http://standards.ieee.org/reading/ieee/std/ (1998)
Vetterling, M., Wimmel, G., Wisspeintner, A.: Requirements analysis: Secure systems development based on the common criteria: the PalME project. In: Proceedings of the tenth ACM SIGSOFT symposium on Foundations of software engineering, November 2002, pp. 129–138 (2002)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, H. (2004). A Framework for Security Assurance in Component Based Development. In: Laganá, A., Gavrilova, M.L., Kumar, V., Mun, Y., Tan, C.J.K., Gervasi, O. (eds) Computational Science and Its Applications – ICCSA 2004. ICCSA 2004. Lecture Notes in Computer Science, vol 3043. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-24707-4_70
Download citation
DOI: https://doi.org/10.1007/978-3-540-24707-4_70
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-22054-1
Online ISBN: 978-3-540-24707-4
eBook Packages: Springer Book Archive