Gerhard Popp

Security-critical system development with extended use cases

Due to increasing interconnection, IT systems are confronted with more and more attacks. To address this problem, we have to consider security requirements from the beginning of the system development. In early phases of system development, it is common to use a hybrid system view which is based on an object oriented modeling of the application core and the specification of use cases. We present an extension of this process for security-critical systems. We show a methodical approach for the development of security-critical systems and the modeling of security aspects in the application core with an extension of the Unified Modeling Language for secure systems development, UMLsec. Furthermore, we introduce security use cases for the development of security aspects in conjunction with behavioral modeling.

Model based development of access policies

In this paper we present a novel approach for the specification of user rights in the context of an object oriented use case driven development process. Basically, we extend the specification of methods by a permission section describing the right of some actor to call the method of an object. Our approach is both role based and context based while allowing for permissions to be specified at a fine-grained data-dependent level. We use first-order logic with a built-in notion of objects and classes (provided with an algebraic semantics) as our syntactic and semantic framework. In the second part of the paper, we demonstrate the application of this approach in a model-based context to generate permissions in distributed peer-to-peer networks.

Towards a Living Software Development Process Based on Process Patterns

A Software Development Process for a certain enterprise and/or a certain project will usually integrate elements from a variety of existing process models, comprising generic standards as well as specific development methods. Besides that, change and evolution of business and technology imply change and evolution of development processes. In this paper we propose a Process Framework, which is modularly structured, and define the concept of process patterns. This framework allows us to describe development processes in such a way that integration, change and evolution of processes are facilitated. An example illustrates our approach.

Modular Process Patterns Supporting an Evolutionary Software Development Process

Change and evolution of business and technology imply change and evolution of development processes. Besides that for a certain enterprise and/or project we will usually integrate elements from a variety of existing process models, comprising generic standards as well as specific development methods. In this paper we propose a Process Framework which is modularly structured on the basis of the concept of process patterns. This framework allows us to describe development processes in a way such that change, evolution, and integration of processes are facilitated. Founded on our framework we sketch the idea of a living development process. An example illustrates our approach.

Actor-Centric Modeling of User Rights

In this paper we present a novel approach for the predicative specification of user rights in the context of an object oriented use case driven development process. We extend the specification of methods by a permission section describing the right of some actor to call the method of an object. Moreover, we introduce a representation function that describes how actors are represented internally in the system. As syntactic and semantic framework we use a first-order logic with a built-in notion of objects and classes provided with an algebraic semantics. We demonstrate that our approach can be realised in OCL.

Towards a tool support for a Living Software Development Process

Change and evolution of business and technology imply change and evolution of development processes. Besides that for a certain enterprise or a project we will usually integrate elements from a variety of existing process models, comprising generic standards as well as specific development methods. In this paper we propose a process model framework which is modularly structured on the basis of the concept of Process Patterns. This framework allows us to describe development processes in a way such that change, evolution, and integration of processes are facilitated. Founded on our framework we sketch the idea of a Living Software Development Process. An important step in this direction is a proper knowledge management tool support. In this paper we discuss and propose the approaches and requirements to fulfill the users specific needs of a sophisticated tool support for a Living Software Development Process.

Towards a Systematic Development of Secure Systems

Abstract In this paper the authors outline a new process model for security engineering. The process model extends object-oriented, use case driven software development by the systematic treatment of security-related issues. Due to the increasing number of distributed applications, security plays a more and more important role within systems development. In particular, evolving new Web technologies supporting the dynamic interconnection between software components and novel mobile devices require a high level of security.

Tool supported development of service-based systems

Service-based systems engineering is a recent paradigm that has proven useful for the development of multifunctional systems, whose functions may be used in different contexts and have strong interrelations and dependencies between each other. Integrated into a service-oriented development process, we present an approach for tool supported design of services and execution scenarios describing their interaction, using the tool AUTOFOCUS. It includes the application of simulation, verification of typical requirements for service-based systems using model checking, and code generation. We report on our experience with this approach by means of a case study from the automotive domain, a fairly new field of application for service-based systems engineering.