This paper presents a sample surveillance use-case based on a video archive search scenario. Privacy and accountability concerns related to video surveillance systems are identified and described here, thus assessing the impact on privacy of this type of systems. Then, after a description of the scenario, we produce the design for this particular context using the SALT methodology developed by the PARIS project. This methodology follows the privacy-by-design approach and ensures that privacy and accountability concerns are properly taken into account for the system under development. This kind of development entails a series of advantages, not only from the point of view of the subject under surveillance, but also for the other system stakeholders.

The modelling, engineering and development of systems with security requirements (which today means all systems) have been the target of different research works that are intended to deal with the increasing complexity of systems and characteristics such as distribution, real-time constraints and heterogeneity and with the need to provide increasing levels of security and privacy for users and businesses. Unfortunately, the situation is that no integral and comprehensive approach has been able to successfully address those challenges and gain acceptance in the industry. In fact, industrial system security engineering is in practice oversimplified, uses inadequate or obsolete solutions and is not treated consistently with the rest of the system engineering to allow an adequate assessment and tracing of the identified security goals, the security decisions made, security mechanisms selected and implemented. As a result, security problems are still too common in most systems. This paper presents a novel engineering process that seamlessly integrates security engineering activities throughout the whole system lifecycle, starting from the very first phases of the engineering process, named integrated security and system engineering process (ISSEP). In order to address the need to use accurate and up-to-date security knowledge by average system engineers, ISSEP follows a separation-of-responsibilities approach. Security knowledge is provided by experts in the form of libraries of engineering artefacts that can then be used by average system engineers in an easy and semi-automatic way. The ISSEP that we present here has been validated in real-world applications by several relevant companies (e.g. RUAG, Technicolor, Mixed Mode, etc.). One of the key points of the ISSEP is that it has been designed to be tool-supported. We have developed different tools to support its application. In particular, the main tool is available as a plugin for MagicDraw that offers support to the different actors in all the steps of the process. An Eclipse-based version is also under development.

Certification has been proved as an essential mechanism for achieving different security properties in new systems. However, it has important advantages; among which we highlighted the increasing in users trust by means of attesting security properties, but it is important to consider that in most of cases the system that is subject of certification is considered to be monolithic, and this feature implies that existing certification schemes do not provide support for dynamic changes of components as required in Cloud Computing running systems. One issue that has special importance of current certification schemes is that these refer to a particular version of the product or system, which derives that changes in the system structure require a process of recertification. This paper presents a solution based on a combination of software certification and hardware-based certification techniques. As a key element in our model we make use of the Trusted Computing functionalities as secure element to provide mechanisms for the hardware certification part. Likewise, our main goal is bringing the gap existing between the software certification and the means for hardware certification, in order to provide a solution for the whole system certification using Trusted Computing technology.

This paper presents a security engineering process for the modelling of security-sensitive systems using a real use case of metering devices. The process provides a security framework that can be used with other existing processes (such as the agile ones). It helps to develop and model systems bearing in mind their heterogeneity, real-time and dynamic behaviors. Besides, due to the critical nature of some of these systems (nuclear, emergency systems, military, etc.) it provides tools for identifying, working and solving security threats by using the knowledge of domain experts. This is very important because threats, properties, solutions, etc. that are valid or relevant in a given domain, are not applicable to other domains and are subject to constant changes. The security requirements of the systems are fulfilled by means of domain-specific security knowledge. These artefacts contain the specific information of a domain (security properties, elements, assumptions, threats, tests, etc.). The solutions are presented as Security Patterns. Each one describes an implementation solution by using one or several Security Building Blocks (SBBs). The security engineering process presented here describes how to model a security-enhanced system model using a library of domain security knowledge. The process has been developed along with a Magic Draw plugin that covers all the possible functionalities, making the work with the models and the security elements very simple and easy for the user.

Service Oriented Computing (SOC) has facilitated a paradigm shift in software provisioning models: software gets consumed as a "service" providing enormous benefits, however lack of security assurance of third-party services is hampering their wider adoption in business- and security-critical domains. Security certification typically provides the required assurance, however applying it as is to SOC is infeasible, given that the natural language representation of resulting certificates is a major obstacle for typical SOC scenarios like service discovery, service composition and so on. To overcome the limitations of existing security certificates we present the concept of a digital security certificate for services. It is realized by a language which enables the representation of a security certificate in a structured, machine processable manner that would enable automated reasoning to be performed on them and thus make it feasible for certified security features to be part of typical SOC scenarios.

The concept of Dynamic Coalitions (DCs) provides a scalable approach for service-based business integration suitable to Small and Medium-size Enterprises (SMEs). An outcome of a DC model is a composite service offered to a market place. The notion of security-by-design certified coalition enables coalition designers/owners to request a certification authority to certify whether the coalition workflow design supports certain security properties of interest by stipulating the security properties individual services have to conform to. This paper presents an approach based on a novel Highly Dynamic Coalition (HDC) concept able to provide workflow operation assurance for security-by-design certified service-based coalitions. Certified HDC models can become an enabler for SMEs to participate in coalition formations guaranteeing a certified level of security. Users of HDC-based services will have assurance for the properties preserved during coalition operation, while service providers will have assurance in providing services during HDC formations and partners' selection phases. We will show how workflow operation assurance is realized by means of service security certificates developed in ASSERT4SOA project.

Software certification has been successfully used with traditional "static" software. With the introduction of new computing paradigms such as service-oriented computing and cloud computing, the existing way to represent software certifications based in verbose human-oriented documents, exhibits many limitations, to the point of making the approach not useful in practice. The ASSERT4SOA project is currently addressing this problem and has developed a computer-oriented representation for software certifications based on a new type of digital certificates called ASSERT. However, in order to be able to represent the huge heterogeneity of certification schemes and standards, the ASSERT specification has to be extremely flexible and rather complex. This in turn, makes the production of ASSERTs difficult, and moreover, limits their interoperability, as to be interoperable, ASSERTS need to follow certain rules. This paper presents the solution adopted in the project in order to improve the interoperability of independently produced ASSERTS. The solution has been evaluated and has received very positive feedback.

Despite the fact that software security certification has important advantages; among these we highlighted that it allows to increase users' trust by means of attesting security properties. However, in most of cases the system that is subject of certification is considered to be monolithic. This fact implies that existing certification schemes do not provide support for dynamic changes of components as required in Cloud Computing scenarios. In existing certification schemes certificates refer to a particular version of the product or system, changes in the system structure require a process of recertification. We propose a solution based on the combination of software certification techniques and hardware-based certification, as those provided by the Trusted Computing technology. Likewise, the main target of our approach is bringing the gap existing between the software certification and the means for hardware certification, in order to provide a solution for the whole system certification using Trusted Computing technology.

The engineering and development of complex security-sensitive systems is becoming increasingly difficult due to the need to address aspects like heterogeneity (of application domains, requirements, regulations, solutions, etc.), dynamism and runtime adaptation necessities, and the high demands for security and privacy of the users and agencies involved in scenarios where these systems work (natural disasters, accidents, terrorism, etc.). Moreover, security knowledge is highly domain-dependent and dynamic. These characteristics make the development of those systems hard because the amount of security knowledge required to dealing with such a huge variety of situations, which becomes way too large for a human. We propose in this paper a securityoriented engineering process that is especially useful for these systems. It makes security fit naturally in the systems by interleaving security into the initial architecture and system description. In particular, the proposed process provides means to identify and manage security properties in a consistent and intuitive manner. To illustrate our experience we use a real-world emergency response scenario. More concretely, we focus on the establishment of a secure ad-hoc wireless mesh communication, which is a key component in the domain of spontaneous broadband communication among crisis management vehicles.

The development of systems based on embedded components is a challenging task because of their distributed, reactive and real-time nature. From a security point of view, embedded devices are basically systems owned by a certain entity, used frequently as part of systems owned by other entities and operated in a potentially hostile environment. The development of security-enhanced systems of embedded components is a difficult task due to different types of threats that may affect such systems, and because the security in systems of embedded devices is currently added as an additional feature when the development is advanced, or avoided as a superfluous characteristic. We present in this paper a methodology for the analysis and modeling of threats and attacks for systems of embedded components. The Intruder Model allows us to describe possible actions a potential intruder can accomplish, depending on his/her capabilities, resources, etc. Using this information, we can define a Threat Model that will specify the threats and attacks that affect different security properties in specific domains.

Security is considered one of the crucial issues for the widespread adoption of cloud computing. Despite all research done in preventive security for cloud computing, the high complexity and the interdependence of many software layers and infrastructures mean that in practice there are always chances for something going wrong. For this reason, there is a need to complement preventive security measures with reactive measures. Among these, monitoring is the most relevant approach. In this paper, we introduce a new and robust architecture for dynamic security monitoring and enforcement specially designed for cloud computing scenarios. Our solution is therefore a complete one including a three-layered architecture, a new language for expressing monitoring rules and a strategy based on the generation of a finite-state machine to improve the performance of the monitoring engine.

Abstract Mobile agent is a promising paradigm for emerging ubiquitous computing and ambient intelligent scenarios. We believe that security is the most important issue for the widespread deployment of applications based on mobile agent technology. Indeed, community agrees that without the proper security mechanisms, use of mobile agent‐based applications will be impossible. From our perspective, the security problem in mobile agents is the gathering of two subproblems; the problem of the agent protection and the problem of the host protection. This paper presents a hardware‐based mechanism focused on solving the protection of the agent problem, which is a well known problem named the ‘malicious host’. The solution presented in this paper bases its security in the trust and the security functionalities provided by the trusted platform module (TPM). Thus, migration process of mobile agents is protected when it actually takes place. A complete description of the secure migration can be found in the secure migration protocol section of this paper. Moreover, a validation of this protocol was performed by means of the AVISPA tool suite. Additionally, a first study about the use of an alternative protocol as the direct anonymous attestation protocol was done. Finally, the result of this work is the Secure Migration Library for agents (SecMiLiA), which is completely described in following sections. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract A coalition consists of independent organizations that share resources and skills to achieve significant mission objectives. Dynamic Coalition (DC) formations occur in response to some market demands, business requests, or disaster responses, to name a few. Partners forming a coalition are automatically selected given some business criteria and become active participants from the time the coalition is formed. Highly dynamic coalitions (HDCs) form a sub class of dynamic coalitions where the coalition formation and operation are strictly bound by time in order to provide a prompt reaction to some events. This type of dynamism poses the necessity of underlying security models and technologies allowing for automated coalition formation and operation. This paper presents a platform‐driven approach to HDCs. It first defines a life cycle inherent to HDC formations, and then presents a platform‐driven access control model that takes advantage of semantics of partners' requirements to provide interoperable access control to resources shared in a coalition. Coalition partners can achieve a high level of service interoperation by enhancing their access control requirements with semantics of usage, and interlinking their semantics using class relations based on standard ontology. Copyright © 2009 John Wiley & Sons, Ltd.

Agent-based computing represents a promising paradigm for distributed computing. Unfortunately the lack of security is hindering the application of this paradigm in real world applications. The protection of malicious hosts is considered the most difficult security problem to solve in mobile agent systems. In this paper we provide a mechanism that aims to solve the problem of the malicious hosts. The core of our work is a new agent migration protocol based on the use of tamper resistant cryptographic hardware. Concretely, we base our work on the use of the Trusted Computing technology. Our protocol has been validated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) model checking tool. As a result we have a library built on JADE that implements the secure migration for agents named Secure Migration Library for Agents (SecMiLiA). This library provides a friendly use of the Trusted Computing technology for agent based system developers.

Ambient Intelligence (AmI) refers to an environment that is sensitive, responsive, interconnected, contextualized, transparent, intelligent, and acting on behalf of humans. AmI environments impose some constraints in the connectivity framework, power computing as well as energy budget. This makes of AmI a significantly different case within distributed systems. The combination of heterogeneity, dynamism, sheer number of devices, along with the growing demands placed on software security and dependability, make application development vastly more complex. Also, the provision of security and dependability for applications becomes increasingly difficult to achieve with the existing security engineering mechanisms and tools. Furthermore the validation of these mechanisms is even a hard task. In this paper we present an approach to model dynamic changes in ambient intelligence scenarios using the Avispa (Automated Validation of Internet Security Protocols and Applications) model-checking tool suite. The main goal ofour approach consists on providing a starting point in the use of Formal Description Techniques (FDM) for AmI scenarios. The paper studies and assesses the suitability of the Avispa tool for security validation in Ambient Intelligent environments and proposes mechanisms to capture the dynamic context changes in these environments.

Mobile agents are processes that can migrate autonomously from new hosts. Despite of the huge number of fields of application of this technology, a lack in the security exists. The main approach of this work is based on the provision of a secure execution environment for mobile agents. Our approach is based on the idea of the trusted migration. This trusted migration is reached by means of the use of cryptographic hardware. Concretely, trusted computing module (TPM). Thus, we have designed and developed a specific protocol, which is the basis to build the solution. In order to build our solution on a robust basis, we have validated this protocol by means of a model checking tool called AVISPA. Finally, we built a library to provide access to TPM (trusted platform module) functionalities. The idea behind of this is based on the easy in using cryptographic hardware in the agent based systems development, disposing to agent developers of the security related tasks of their systems. The most relevant aspects of this library are described along this paper both at development stage of it and while we use it to develop a system based agent.

Software agents are a promising computing paradigm. Scientific community has devoted important efforts to this field [1]. Indeed, several important applications exist based on this technology. Despite of their benefits, the lack of the appropriate security mechanisms for agent based systems represents a barrier for the widespread use of this technology. Additionally, the application of the current security techniques is not trivial for agent based system developers, which are usually not security experts. This paper presents a hardware based protection infrastructure that takes advantage of the recent advances in trusted hardware in order to solve the problem known as the malicious host in mobile agent systems. This infrastructure is composed of extensions to the JADE framework and the Trusted Computing technology. Additionally, the protocol used in this implementation has been validated using the Automated Validation of Internet Security Protocols and Applications (AVISPA) as we described in the paper.

Formal methods, especially in the field of model checking, have been used traditionally to analyse security solutions in order to determine whether they fulfil certain properties. Practical results have proven the suitability and advantages of the use of formal approaches for this purpose. However, in these works the definition of the different security properties shows two main problems: (i) properties are frequently assumed to have a universal definition; and (ii) the definition of security properties is strongly dependent on the underlying verification model. In this paper we introduce a different approach to the formal specification of security properties. We argue that security properties should be defined in formal, intuitive and abstract terms, and that reasoning mechanisms must exist for these specifications in order to relate different properties. Our goal is to reason about properties in order to guarantee interoperability of these properties and consequently of the solutions complying with them.

The first edition of SAPS (in 2004) focused on the development of tools to automate software engineering processes with support for security. Our focus in this edition will be on the tools to automate processing, validation and monitoring of security requirements, both during development and during operation of the system. Security and reliability issues are rarely considered at the initial stages of software development. The erroneous consideration of security technology as supplementary, and the lack of integration of security engineering techniques within software engineering processes have very negative consequences. Approaches integrating security issues in software engineering processes are especially relevant to SAPS. Good security measures can fail due to errors in design or implementation. Therefore, automated tools are essential for the analysis and deployment of secure systems. Comprehensive approaches, encompassing all phases of development are encouraged. Furthermore, in the near future, the increasing dynamism, heterogeneity and complexity of emerging computing paradigms and environments such as grid computing, mixed-mode systems or ambient intelligence, along with the disappearing notion of system boundaries introduced by these paradigms, will make it impossible for security engineers to foresee all possible situations that may arise during system operation, therefore increasing the need for automated support for the processing of security.