A Framework for Composable Security Definition, Assurance, and Enforcement

The objective of this research is to develop techniques that integrate alternative security concerns (e.g., mandatory access control, delegation, authentication, etc.) into the software process. The resulting model-driven framework preserves separation of security concerns from modeling through implementation, and allows security personnel to pick and choose security concerns to concerns promotes security assurance, and should result in a reduction of the security defects in the final system. To achieve separation of concerns at the modeling level, concern-specific languages are defined to capture alternative security concerns. At the implementation level, aspectoriented programming is used to integrate security concerns into an application’s code, while preserving modularity. This composition seamlessly combines the chosen security concerns to realize an application’s security infrastructure.