To Download the Entire Issue
Total Page:16
File Type:pdf, Size:1020Kb
Reliability Digest, November 2014 Officers(Excom) President Sr. Past President Jr. Past President Christian Hansen Jeffrey Voas Dennis Hoffman Vice Presidents Technical Activities Publications Meetings and Conferences Membership Shiuhpyng Winston Shieh Phil Laplante Alfred Stevens Marsha Abramo Secretary Treasurer W. Eric Wong Bob Loomis Elected Members-at-Large (with vote) TERM EXPIRES 2014 TERM EXPIRES 2015 TERM EXPIRES 2016 (DEC 31) (DEC 31) (DEC 31) Scott B. Abrams Carole Graas Marsha Abramo Shiuhpyng Winston Shieh Lou Gullo Zhaojun (Steven) Li Pierre Dersin Samuel J. Keene Loretta Arellano Alfred Stevens Christian Hansen Bob Loomis Wei Dong Phil LaPlante Lon Chase Rex Sallade Pradeep Lall Pradeep Ramuhalli Standing Committees and Activities/Initiatives Web Master Standards Chapters Coordinator Professional Development Constitution and Bylaws Lon Chase Lou Gullo Loretta Arellano Marsha Abramo Dennis Hoffman Fellows Finance Academic Meetings Organization Membership Development Sam Keene Christian Hansen Education/Scholarship Alfred Stevens Marsha Abramo Sam Keene Transactions Editor Newsletter Editor Video Tutorials Nominations and Awards Life Science Initiative Way Kuo Joe Childs Christian Hansen Jeffrey Voas Peter Ghavami Transportation IEEE Press Liaison Electification Dev Raheja Sam Keene Pradeep Lall Michael Austin IEEE Government Relations Committees Energy Policy Transportation and Aerospace Policy Medical Technology Policy Jeff Voas Scott Abrams Jeff Voas Critical Infrastructure Protection Career and Workforce Policy Intellectual Property Committee Sam Keene Christian Hansen Carole Graas (corresponding only) (corresponding only) Research and Development Committee Combined TAB Ad Hoc Committee on Attracting 2013 TAB Awards and Recognition Committee Pradeep Lall Industrial Members (TABARC) Dennis Hoffman Dennis Hoffman 1 Reliability Digest, November 2014 Technical Committee on Internet of Things (IoT) Technical Committee on System and Software Assurance Technical Committee on Prognostics and Health Management (PHM) Technical Committee on Trustworthy Computing and Cybersecurity Technical Committee on Reliability Science for Advanced Materials & Devices Technical Committee on Systems of Systems 2 Reliability Digest, November 2014 Standards Committee Working Group on Education 3 Reliability Digest, November 2014 Editor-in-Chief Shiuhpyng Winston Shieh, Area Editors Jeffrey M. Voas, Internet of Things (IoT) Irena Bojanova, Internet of Things (IoT) Eric Wong, System and Software Assurance Rex Sallade, Prognostics and Health Management (PHM) Pradeep Lall, Prognostics and Health Management (PHM) Wen-Guey Tzeng, Trustworthy Computing and Cybersecurity Carole Graas, Reliability Science for Advanced Materials & Devices Pierre Dersin, Systems of Systems Editorial Staff Emma Lin Vic Hsu Michael Cho 4 Reliability Digest, November 2014 5 Reliability Digest, November 2014 6 Reliability Digest, November 2014 7 Reliability Digest, November 2014 Software Model Modeling of Secure and Dependable Applications Based on a Repository of Patterns- The SEMCO Approach Brahim Hamid Testing and Evaluation Advanced Dependence Analysis for Software Testing, Debugging, and Evolution Raul Santelices, Haipeng Cai, Siyuan Jiang and Yiji Zhang Application of Multi-Model Combinations to Evaluate the Program Size Variation of Open Source Software Shih-Min Huang and Chin-Yu Huang Cloud Computing Memory Demand Projection for Guest Virtual Machines on IaaS Cloud Infrastructure Yi-Yung Chen, Yu-Sung Wu and Meng-Ru Tsai Security and Privacy Exploit Generation from Software Failures Shih-Kun Huang and Han-Lin Lu The Achilles Heel of Antivirus Chia-Wei Wang, Chong-Kwan Chen and Shiuhpyng Shieh 8 Reliability Digest, November 2014 Modeling of Secure and Dependable Applications Based on a Repository of Patterns: The SEMCO Approach Brahim Hamid IRIT- University of Toulouse 118 Route de Narbonne, 31062 Toulouse Cedex 9, France [email protected] security and dependability, in the cases of modern systems, the Abstract—The requirement for higher quality and seamless “walled-garden” paradigm is unsuitable and the traditional development of systems is continuously increasing, even in security and dependability concepts are ineffective, since it domains traditionally not deeply involved in such issues. was based on the fact that it is possible to build a wall between Security and Dependability (S&D) requirements are the system and the outer world. In our opinion the foundation incorporated to an increasing number of systems. These newer for comprehensive security and dependability engineering is a restrictions make the development of those systems more deep understanding of the modern systems, ongoing or complicated than conventional systems. In our work, we previous security and dependability incidents and their promote a new approach called SEMCO (System and software Engineering with Multi-COncerns) combining Model-Driven implications on the underlying critical infrastructure. Engineering (MDE) with a model-based repository of S&D The industrial context conducting our work is how to take patterns to support the design and the analysis of pattern- into account several constraints, mainly those related to based secure and dependable system and software security and dependability, that are not satisfied by the well- architectures. known and the widely used technology for building The modeling framework to support the approach is based on a applications for Resource-Constrained Embedded Systems. set of modeling languages, to specify security and dependability These requirements introduce conflicts on the three main patterns, resources and a set of property models, and a set of factors that determine the cost of ownership of applications: (a) model transformation rules to specify some of the analysis cost of the production, (b) cost of engineering and (c) cost of activities. As part of the assistance for the development of S&D applications, we have implemented a tool-chain based on the maintenance. In other words, systems with high dependability Eclipse platform to support the different activities around the requirements for which the security level must be repository, including the analysis activities. The proposed demonstrated and certified use almost exclusively technical approach was evaluated through a case study from the railway solutions strongly oriented by the application domains. domain. Applications based on these solutions are by definition dedicated, hardly portable between different execution Keywords— Security, Dependability, Resource, Pattern, platforms and require specific engineering processes. These Model-driven Engineering, Embedded Systems Engineering. specificities greatly increase the cost of the development in the different phases of their lifecycle. Embedded systems share a large number of common characteristics, including real-time and physical constraints I. INTRODUCTION (e.g. temperature), as well as energy efficiency requirements. During the last decades, the systems have grown with an Specifically, Resource Constrained Embedded Systems refer increasing in terms of complexity and connectivity. In the past to systems which have memory and/or computational Security and Dependability (S&D) was not such a critical processing power constraints computing resources of RCES, concern of system development teams, since it was possible to e.g. memory, tasks, and buffers, are generally statically rely on the fact that a system could be easily, controlled due to determined. The generation of RCES therefore involves its limited connectivity and, in most of the cases, its dedicated specific software building processes. These processes are often focus. However, nowadays, systems are growing in terms of error-prone because they are not fully automated, even if some complexity, functionality and connectivity not only in safety- level of automatic code generation or even model driven critical areas (defense, nuclear power generation, etc.), but engineering support is applied. Furthermore, many RCES also also in areas such as finance, transportation, medical have assurance requirements, ranging from very strong levels information management and system using web applications. involving certification (e.g. DO178 and IEC-61508 for safety- Just consider Resource Constrained Embedded Systems relevant embedded systems development) to lighter levels (RCES) [1] and their added complexity and connectivity. The based on industry practices. Consequently, the conception and aforementioned challenges in modern system development design of RCES is an inherently complex endeavor. To cope push the Information and Communication Technologies (ICT) with the growing complexity of embedded system design, community to search for innovative methods and tools for several development approaches have been proposed. The serving these new needs and objectives. Regarding system 9 Reliability Digest, November 2014 most popular are those using models as main artifacts to be A repository should provide a modeling container to support constructed and maintained. modeling artifacts lifecycle associated with different In embedded system design field, the integration of non- methodologies. The patterns that are at the heart of our system functional requirements from Security and Dependability engineering process reflect design solutions at domain (S&D) [2], [3] are exacerbating this complexity, mainly in the independent and specific level, respectively. context of trade-offs. For instance, in the