A high-level aspect-oriented-based framework for software security hardening

Information Security Journal

Volumn 17, Issue 2, 2008, Pages 56-74

  Mourad, Azzam ^a   Laverdière, Marc André ^a   Debbabi, Mourad ^a  

^a University of Concordia   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 58049134438     PISSN: 19393555     EISSN: 19393547     Source Type: Journal    
DOI: 10.1080/19393550801911230     Document Type: Article

References (38)

1. Bishop, M. (2002). Computer Security: Art and Science. Boston, MA: Addison-Wesley Professional.
2. Bishop, M. (2002). How Attackers Break Programs, and How to Write More Secure Programs. http://nob.cs.ucdavis.edu/1oishop/secprog/ sans2002/index.html. Accessed April 19, 2007.
3. Blakley, B., Heath, C., (2004). The Open Group Security Forum. Security design patterns, Technical Report G031. Open Group.
4. Bodkin, R. (2004). Enterprise security aspects. In Proceedings of the AOSD 04 Workshop on AOSD Technology for Application-level Security (AOSD'04:AOSDSEC), Lancaster, UK, March 2004.
5. Bollert, K. (1999). On weaving aspects. In International Workshop on Aspect- Oriented Programming at ECOOP99, Lisbon, Portugal, June 1999.
6. Braga, A.M., Rubira, C.M.F. and Dahab, R. (1999). Tropyc: A pattern language for cryprographic software. Technical Report IC-99-03, Institute of Computing, UNICAMP, January.
7. Clarke, D., Drossopoulou, S., Noble, J., and Wrigstad, T. (2007). Tribe: a simple virtual class calculus. In AOSD '07: Proceedings of the 6th international conference on Aspect-oriented software development, pages 121-134. New York: ACM Press.
8. Coady, Y., Kiczales, G., Feeley, M., and Smolyn, G. (2001). Using aspectc to improve the modularity of path-specific customization in operating system code. In Proceedings of Foundations of software Engineering. Vienna, Austria.
9. DeWin, B., Vanhaute, B., and De Decker, B. (2001). Security through aspect-oriented programming. In Proceedings of the IFIP TC11 WG11.4 First Annual Working Conference on Network Security: Advances in Network and Distributed Systems Security, pages 193-194, Leuven, Belgium, November 2001.
10. DeWin, B. (2004). Engineering Application Level Security through Aspect Oriented Software Development. Ph.D.thesis, Kathoheke Universiteit Leuven.
11. DeWin, B., Vanhaute, B., and De Decker, B. (2002). How aspect- oriented programming can help to build secure software, Informatica (Slovenia), 26(2).
12. Douence, R., Fritz, T., Loriant, N., Menaud, J.-M., Ségura-Devillechaise, M., and Südholt, M. (2005). An expressive aspect language for system applications with arachne. In AOSD '05: Proceedings of the 4th international conference on Aspect-oriented software development, pages 27-38, New York: ACM Press.
13. Engel, M. and Freisleben, B. (2005). Supporting autonomic computing functionality via dynamic operating system kernel aspects. In AOSD '05: Proceedings of the 4th international conference on Aspect- oriented software development, pages 51-62, New York: ACM Press.
14. Lee Brown, F. Jr., DiVietri, J., Diaz de Villegas, G., and Fernandez, E.B. (1999). The authenticator pattern. In Proceedings of the 6th Annual Conference on the Pattern Languages of Programs (PLoP99), Urbana, IL, USA, August 1999.
15. Fernandez, E.B. and Warrier, R. (2003). Remote authenticator/autho- rizer. In Proceedings of the 10th Conference on Pattern Languages of Programs (PLoP2003), Monticello, IL, USA, September 2003.
16. Howard, M. and LeBlanc, D.E. (2002). Writing Secure Code. Redmond, WA: Microsoft Press.
17. Huang, M., Wang, C., and Zhang, L. (2004). Toward a reusable and generic security aspect library. In Proceedings of the AOSD 04 Workshop on AOSD Technology for Application-level Security (AOSD'04:AOSDSEC).
18. Kiczales, G., Hilsdale, E., Hugunin, J., Kersten, M., Palm, J., and Griswold, W. (2001). Overview of aspectj. In Proceedings of the 15th European Conference ECOOP, Budapest, Hungary. Springer Verlag.
19. Kienzle, D. M. and Elder, M. C. (2002). Final technical report: Security patterns for web application development. Technical Report DARPA Contract # F30602-01-C-0164. http://www.modsecurity.org/archive/ securitypatterns/dmdj_final_report.pdf. Accessed April 19, 2007.
20. Kienzle, D. M., Elder, M. C., Tyree, D. and Edwards-Hewitt, J. (2002). Security patterns repository. http://www.modsecurity.org/archive/ securitypatterns/dmdj_repository.pdf. Accessed April 19, 2007.
21. Kim, H. (2002). An aosd implementation for c#. Technical Report TCD-CS2002-55, Department of Computer Science, Trinity College, Dublin.
22. Mourad, A., Laverdière, M. A., and Debbabi, M. (2006). Security hardening of open source software. In Proceedings of the 2006 International Conference on Privacy, Security and Trust (PST 2006). McGraw-Hill: ACM Press.
23. Mourad, A., Laverdière, M.-A., and Debbabi, M. (2007). Towards an aspect oriented approach for the security hardening of code. In Proceedings of the 3rd IEEE International Symposium on Security in Networks and Distributed Systems. IEEE Press. Niagara Falls, Canada, May 2007.
24. Navarro, L.D.B., Südholt, M., Vanderperren, W., De Fraine, B. and Suvée, D. (2006). Explicitly distributed aop using awed. In AOSD '06: Proceedings of the 5th international conference on Aspect-oriented software development, pages 51-62. New York: ACM Press.
25. Sasha Romanosky, S. (2001). Security design patterns part 1. http:// www.romanosky.net/. Accessed in 2005.
26. Markus Schumacher, M. (2003). Security Engineering with Patterns. New York: Springer.
27. Schumacher, M., Fernandez-Buglioni, E., Hybertson, D., Buschmann, F. and Sommerlad, P. (2006). Security Patterns: Integrating Security and Systems Engineering. Hoboken, NJ: Wiley.
28. Seacord, R.C. (2005). Secure Coding in C and C++. SEI Series. Boston, MA: Addison-Wesley.
29. Shah, C. and Hill, F. (2003). Aspect-oriented programming security framework. In Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX 03), pages 143-145. IEEE Press.
30. Shah, V. (2003). An aspect-oriented security assurance solution. Technical Report AFRL-IF-RS-TR-2003-254, Cigital Labs.
31. Shah, V. and Hill, F. (2002). Using aspect-oriented programming for addressing security concerns. In Proceedings of the Thirteenth International Symposium on Software Reliability Engineering (ISSRE), pages 115-119, Annapolis, MD, USA, November 2003.
32. Slowikowski, P. and Zielinski, K. (2003). Comparison study of aspect- oriented and container managed security. In Proceedings of the ECCOP workshop on Analysis of Aspect-Oriented Software. Darmstadt, Germany, July 2003.
33. Spinczyk, O., Gal, A., and Chroder Preikschat, W. (2002). Aspectc++: An aspect-oriented extension to c++. In Proceedings of the 40th International Conference on Technology of Object-Oriented Languages and Systems, Sydney, Australia.
34. Vanhaute, B. and DeWin, B. (2001). Security and genericity. In Proceedings of the 1st Belgian AOSD Workshop, Belgium, November 8.
35. Viega, J., Bloch, J.T., and Pravir, C. (2001). Applying aspect-oriented programming to security. Cutter IT Journal, 14(2):31-39.
36. Wheeler, A. (2003). Secure Programming for Linux and Unix HOWTO - Creating Secure Software v3.010. http://www.dwheeler.com/secure- programs/. Accessed April 19, 2007.
37. Xu, D., Goel, V., and Nygard, K. (2006). An aspect-oriented approach to security requirements analysis. In 30th Annual International Computer Software and Applications Conference (COMPSAC'06), pages 79-82, Los Alamitos, CA: IEEE Computer Society.
38. Yoder, J. and Barcalow, J. (1997). Architectural patterns for enabling application security. In Proceedings of the 4th Annual Conference on the Pattern Languages of Programs (PLoP97).