^`Nrfpfqflk=Oةًة~يإ = Pىهمًهيةا=Oةىهيٍ=ًةيفةً=
Total Page：16
File Type：pdf, Size：1020Kb
UCI-AM-12-195 ^`nrfpfqflk=oÉëÉ~êÅÜ= péçåëçêÉÇ=oÉéçêí=ëÉêáÉë= Investigating Advances in the Acquisition of Secure Systems Based on Open Architectures 30 August 2012 A Compilation of Reports by Thomas A. Alspaugh, Project Scientist Walt Scacchi, Senior Research Scientist Institute for Software Research University of California, Irvine With contributions from Craig Brown, Programmer/Analyst Kari Nies, Programmer/Analyst Institute for Software Research University of California, Irvine Rihoko (Inoue) Kawai, Associate Professor, Saitama Institute of Technology Hazeline U. Asuncion, Assistant Professor Computing and Software Systems University of Washington, Bothell Approved for public release, distribution is unlimited. Prepared for: Naval Postgraduate School, Monterey, California 93943 = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v= =============k^s^i=mlpqdo^ar^qb=p`elli= The research presented in this report was supported by the Acquisition Research Program of the Graduate School of Business & Public Policy at the Naval Postgraduate School. To request defense acquisition research, to become a research sponsor, or to print additional copies of reports, please contact any of the staff listed on the Acquisition Research Program website (www.acquisitionresearch.net). = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v= =============k^s^i=mlpqdo^ar^qb=p`elli= About the Authors Thomas A. Alspaugh is a project scientist at the Institute for Software Research, University of California, Irvine. His research interests are in software engineering, requirements, and licensing. Before completing his PhD, he worked as a software developer, team lead, and manager in industry, and as a computer scientist at the Naval Research Laboratory on the Software Cost Reduction, or A‐7 project. Thomas A. Alspaugh Institute for Software Research University of California, Irvine Irvine, CA 92697‐3455 Tel: 949‐824‐4130 Fax: 949‐824‐1715 E‐mail: [email protected] Walt Scacchi is a senior research scientist and research faculty member at the Institute for Software Research, University of California, Irvine. He received a PhD in information and computer science from UC Irvine in 1981. From 1981 to 1998, he was on the faculty at the University of Southern California. In 1999, he joined the Institute for Software Research at UC Irvine. He has published more than 150 research papers and has directed 60 externally funded research projects. In 2012, he serves as general co‐chair of the Eighth IFIP International Conference on Open Source Systems (OSS2012). Walt Scacchi Institute for Software Research University of California, Irvine Irvine, CA 92697‐3455 Tel: 949‐824‐4130 Fax: 949‐824‐1715 E‐mail: [email protected] Craig Brown was a programmer/analyst at the Institute for Software Research, University of California, Irvine, until Fall 2011. He received a B.S. In Information and Computer Science at UCI in 2009, and then joined ISR. Starting Fall 2011, he entered the M.S. Program in Game Design and Video Game Development at The Guildhall at Southern Methodist University, and expects to complete his degree in Spring 2013. Craig Brown The Guildhall Southern Methodist University [email protected] Kari Nies is a senior programmer/analyst at the Institute for Software Research, University of California, Irvine. She received a B.S. and M.S in Information and Computer Science from UCI. She has been at ISR since 1990. Kari Nies Institute for Software Research University of California, Irvine = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - iii - =============k^s^i=mlpqdo^ar^qb=p`elli= Irvine, CA 92697‐3455 Tel: 949‐824‐8756 Fax: 949‐824‐1715 [email protected] Rihoko (Inoue) Kawai, is an associate professor on the Faculty of Human and Social Studies, Department of Information Society Studies, at the Saitama Institute of Technology in Saitama, Japan. Rihoko (Inoue) Kawai, Saitama Institute of Technology Saitama, Japan [email protected] Hazeline U. Asuncion, is an assistant professor in the Department of Computing and Software Systems at the University of Washington, Bothwell. Her research interests focus on software architecture, workflows, and software acquisition. Hazeline U. Asuncion Computing and Software Systems University of Washington, Bothell Bothell, WA 98011‐8246 USA = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - iv - =============k^s^i=mlpqdo^ar^qb=p`elli= Acknowledgments Support for this research and the production of research publications included comes primarily from grant #N00244‐12‐1‐0004 from the Acquisition Research Program at the Naval Postgraduate School. Additional support also contributing to this effort includes grant #N0024‐10‐1‐0064 from the Center for Edge Power, also at the Naval Postgraduate School, and grant #0808783 from the National Science Foundation. No review, approval, or endorsement is implied. = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - v - =============k^s^i=mlpqdo^ar^qb=p`elli= THIS PAGE INTENTIONALLY LEFT BLANK = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - vi - =============k^s^i=mlpqdo^ar^qb=p`elli= UCI-AM-12-195 ^`nrfpfqflk=oÉëÉ~êÅÜ= péçåëçêÉÇ=êÉéçêí=ëÉêáÉë= Investigating Advances in the Acquisition of Secure Systems Based on Open Architectures 30 August 2012 A Compilation of Reports by Thomas A. Alspaugh, Project Scientist Walt Scacchi, Senior Research Scientist Institute for Software Research University of California, Irvine With contributions from Craig Brown, Programmer/Analyst Kari Nies, Programmer/Analyst Institute for Software Research University of California, Irvine Rihoko (Inoue) Kawai, Associate Professor, Saitama Institute of Technology Hazeline U. Asuncion, Assistant Professor Computing and Software Systems University of Washington, Bothell Disclaimer: The views represented in this report are those of the author and do not reflect the official policy position of the Navy, the Department of Defense, or the Federal Government. = = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - vii - ==============k^s^i=mlpqdo^ar^qb=p`elli= = THIS PAGE INTENTIONALLY LEFT BLANK = = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - viii - ==============k^s^i=mlpqdo^ar^qb=p`elli= = Table of Contents Table of Contents ............................................................................................... ix Executive Summary .......................................................................................... xii Investigating Advances in the Acquisition of Secure Systems Based on Open Architectures ................................................................. 1 Overview and Background for this Research ............................................. 1 Problem for Acquisition Research .............................................................. 3 Issues for Acquisition Research ................................................................. 3 Inter-Project Research Coordination .......................................................... 3 Prospects for Longer-Term Acquisition-Related Research ........................ 4 Statement of Research Status and Results................................................ 4 References ................................................................................................. 5 Addressing Challenges in the Acquisition of Secure Software Systems With Open Architectures ......................................................... 9 Abstract ...................................................................................................... 9 Introduction ................................................................................................ 9 Challenges of Securing Systems With Open Architectures ...................... 10 Securing Software Systems ..................................................................... 13 Product Lines: Alternatives, Versions, Variants of OA Elements .............. 16 Secure Software Product Lines within an OA Software Ecosystem ......... 17 Case Study: A Secure Product Line for an Enterprise System................. 21 Discussion and Conclusions .................................................................... 28 References ............................................................................................... 28 Acknowledgments .................................................................................... 31 = = ^Åèìáëáíáçå=oÉëÉ~êÅÜ=mêçÖê~ã= do^ar^qb=p`elli=lc=_rpfkbpp=C=mr_if`=mlif`v - ix - ================k^s^i=mlpqdo^ar^qb=p`elli= Exploring the Potential of Virtual Worlds for Decentralized Command and Control........................................................................... 33 Abstract .................................................................................................... 33 Overview .................................................................................................. 33 Developing a DECENT Prototype ............................................................ 34 Developing Virtual Worlds of Physical Places .......................................... 35 Under-Explored Topics for DECENT ........................................................ 41 Conclusions and Recommendations for Future Study ............................. 44 References ............................................................................................... 45 Acknowledgments