Secure systems development with UML ( 2005)

delivery due delivered undeliveredBusiness Customer Wait until Deliver Pick up Reclaim Pay Request good {start={Pay}} {stop={Reclaim,Pick up}} Purchase «fair exchange»... receive /return

Jan Jürjens

Secure Systems Development with UML

Library of Congress Control Number: 2004112217

ACM Computing Classification (1998): D.2.2, D.2.4

ISBN 3-540-00701-6 Springer Berlin Heidelberg New York

Jan Jürjens

Dep of Informatics

Software and Systems Engineering

Technische Universität München

Springer is a part of Springer Science+Business Media

Cover design: KünkelLopka, Heidelberg

Production: LE-TeX Jelonek, Schmidt & Vöckler GbR, Leipzig

Typesetting: by the Authors

Printed on acid-free paper 45/3142/YL - 5 4 3 2 1 0

7>-



delivery due delivered undelivered

Business Customer

Wait until

Deliver

Pick up Reclaim

Pay Request good

{start={Pay}} {stop={Reclaim,Pick up}}

Purchase «fair exchange»

money+x wm(x) [money<1000]

rx()/return(false) rm()/return(money)

/money:=0

«no down−flow»

Sender sending

Send

Request Wait

9

n:=n+1 entry/

c

entry/nt:=0 entry/n:=0

i

l entry/

n<limit nt<limit

receive() /return(d’)

transmit(d’) r:

R:Receiver send(d:Data)

«send»

S:Sender sending

!"
#  

Business Customer

Wait until

Deliver

Pick up Reclaim

Pay Request good

{start={Pay}} {stop={Reclaim,Pick up}}

Purchase «fair exchange»

{right=(credit approver, authorize credit)}

{role=(supervisor, credit approver)}

obtain details

 89

server machine web server

Key generation «secure dependency»

«critical» {high={random()}}

tls: S :Server

i

C:Client TLS variant «data security» {adversary=default}



9



8

99



8

999

wm(x) money+x /money:=

money+x wm(x) [money<1000]

rx()/return(false) rm()/return(money)

/return [sig=bank slot=true]

[sig=cert] /return

/return [sig=finan limit=true]

ExcGd chkGd()

chkGd() chkGd()

MicroKey: Keys Sign(req:Exp):Exp Read():Exp

ExcData: Exp

[obj=StoFi] /FinGd.chkGd(sig) /return(FinEx)

CheckReq

CheckReq chkGd(sig)

MGdReturn?

FGdReturn?

/return(MicSi) return WaitReq return

receive() /return(d’)

transmit(d’) r:

R:Receiver send(d:Data)

«send»

S:Sender sending

r s

WaitReq

send(d) /request() return(C)

receive() transmit(E)

SecureChannel

R:Receiver S:Sender

receive() /return(d’)

transmit(d’) r:

R:Receiver send(d:Data)

«send»

S:Sender sending

/

r s

WaitReq

send(d) /request() return(C)

receive() transmit(E)

SecureChannel

R:Receiver S:Sender

tls: S :Server

i

C:Client TLS variant «data security» {adversary=default}



9



8

9



8999



8

9



8

999

33

33



Card Issuer Load

Device

Operator System POS

Device

Card

Appl.

PSAM LSAM

Chip Card Reader

Display (Optional)

Key Pad

Receipt Printer (Optional)

Scheme Operating Data

Transaction Data store

Power Supply

Collection Interface

PSAM

POS Terminal Application

«POS device» POS device

Card

C:CEPS

PSAM PSAMapp P:PSAM

P:PSAM D:Display

D:Display C:CEPS P:PSAM

purch.D entry/NT:=NT+1

99



899



Terminal Application Functions

Load Host

Card Issuer

Display/

Cardholder Interface Secure PIN pad

RespC(s3,rc)

hl,h2l) Comp(cep,lda,m,nt,r2l,s3) Load(cep,lda,m,nt,s1,ml,h

ILog

«send»

RespI(cep,nt,sl,hc) RespC(s3,rc)

Fail Load

«send»

hl,h2l) Comp(cep,lda,m,nt,r2l,s3) Load(cep,lda,m,nt,s1,ml,h

RespI Init

)+1      


/return [sig=bank slot=true]

[sig=cert] /return

/return [sig=finan limit=true]

ExcGd chkGd()

chkGd() chkGd()

MicroKey: Keys Sign(req:Exp):Exp Read():Exp

ExcData: Exp

[obj=StoFi] /FinGd.chkGd(sig) /return(FinEx)

CheckReq

CheckReq chkGd(sig)

MGdReturn?

FGdReturn?

/return(MicSi) return WaitReq return

Client Webserver Backend

*

 ##


M2 M3

M1 M0

l (U ML 1.4 M etam ode l)

4: M yU ml.x mi

Error Analyzer

“uses" data flow

user -name : String

-role_id : int

role -name : String -role_id : int

transaction -name : String

-role_id : int

-transaction_id : int

permission -name : String -role_id : int -transaction_id : int

+name: karen +uid: 502 +role: admins

constraint -element : String -condition : String

contains

0 *

type -PROHIBITION : int = 1

model (CASE tool) create

XML

create rules (GUI)

XML (rules)

analyzer

security−report (format defined

by templates)

SAP

Rule creation Business Application

9:







call(x1) /store(x2) /call(x4)

Wait Send

/transmit(d) send(d)

'#


)##

/

ExcGd chkGd()

chkGd() chkGd()

MicroKey: Keys Sign(req:Exp):Exp Read():Exp

ExcData: Exp

[obj=StoFi] /FinGd.chkGd(sig) /return(FinEx)... data-page="220">

call(x1) /store(x2) /call(x4)

Wait Send

/transmit(d) send(d)... data-page="168">

model (CASE tool) create

XML

create rules (GUI)

XML (rules)

analyzer

security−report (format defined