Literature Reviews

implied scenarios, and how to create MSCs; they were not required to understand what

implied scenarios are, or how they are detected. The students modeled the system in

MSC using the LTSA-MSC tools and all generated implied scenarios were recorded

and evaluated. The use of sequence charts is believed to be one of the most widely used

models in the software industry [38], thus using such models does not introduce an

overhead on the industry to adopt the approach. Another prerequisite for the approach

is basic understanding about security properties, and how they are violated.

10.7.1 Case study background The case study aimed at evaluating two identity management models (device-based

and service-based) [39] implemented in an online bargain shop (OBS) for security

vulnerabilities. Retailers and wholesalers can subscribe to the OBS system in order

to advertise their online products, while buyers can sign up to OBS to browse offer-

ings and search for and buy products. The architecture uses temporary sessions

assigned for every user. The user will access the portal by providing a username

and password, which in turn will provide access to a third party web service (e.g.,

Amazon). Once the user enters the credentials, the portal will forward the request

for authentication to the session generator, which in turn will determine whether

the username and password are valid by comparing them with the values stored in

the user credential database. The desired communication is illustrated in Figure 10.2.

Device-based identity utilizes security credentials on the device to authenticate

with services and uses the identity provider (IdP) to distribute the public key for the

identity and maintains a list of attributes. It introduces a security token, which is sent

to the users’ device for authentication. Security credentials are stored in the device

and are used to identify the service and authenticate the device requesting the service;

thus, “each device maintains its own credentials for the user identity” [39]. The

desired behavior is illustrated in Figure 10.3.

10.7.2 Approach and results Each model contained four legitimate scenarios generated from the code with its

hMSC. We have applied our approach to both models and compared our results with

respect to the following security properties [12]: confidentiality, integrity, authenti-

cation, and availability. As new behaviors were detected using the LTSA-MSC tool,

the developers were involved to decide whether the behavior was positive or not (i.e.,

“Is it a design defect with potential security implications, or is it an undesirable infer-

ence?”). In cases where additional behaviors were positive, they were added to the

model supporting continuous refinement and addition of new requirements. Further

investigation was performed incrementally and iteratively to ensure that additional

behaviors do not cause integration errors.

The device-based model proved to be more vulnerable to security vulnerability

exploitation, since it had a total of three negative implied scenarios and violated the

confidentiality, integrity, and availability requirements. On the other hand, the

256 CHAPTER 10 Agile Architecture for Security Testing

Agile Software Architecture : Aligning Agile Processes and Software Architectures, edited by Muhammad Ali Babar, et al., Elsevier Science & Technology, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/harrisburg-ebooks/detail.action?docID=1574922. Created from harrisburg-ebooks on 2020-11-24 13:34:56.

C op

yr ig

ht ©

2 01

3. E

ls ev

ie r

S ci

en ce

& T

ec hn

ol og

y. A

ll rig

ht s

re se

rv ed

.