Annotated Sequence Diagrams for Security Threat Identification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Complex business scenarios involving multiple devices and service providers create security challenges due to intricate interactions, making it difficult for development teams to identify and test security threats effectively using conventional methods, especially since formal models are complex and costly to manage.

Innovation Solution

The use of annotated sequence diagrams that capture security information such as security goals, communication channel properties, and WHAT-IF conditions allows for the identification of potential security threats at design-time and automatic testing at run-time, facilitating the detection of subtle security flaws like Man-in-the-middle and confidentiality issues.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional security testing methods are used in complex business scenarios, then development teams can identify security threats, but the process becomes difficult and ineffective due to intricate interactions among multiple devices and service providers

Engineering Contradiction:

Improvesecurity threat identification effectivenessVSAvoiddifficulty of identifying and testing security threats

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments the complex security testing process into distinct phases: design-time threat identification using annotated sequence diagrams, formal model generation, and run-time automated testing. This segmentation allows each phase to be handled with appropriate methods, making the overall process more manageable and effective despite system complexity

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary security analysis at design-time by creating annotated sequence diagrams that identify potential threats before the system is deployed. This preliminary action includes defining security goals, annotating messages with security properties, and generating formal models in advance, which then guide the automated testing process and reduce the complexity of runtime security verification

Inventive Principle:

Principle #10Preliminary action

2Reliability

If formal models are used for security threat identification, then security analysis can be performed, but the complexity and cost of managing formal models increases

Engineering Contradiction:

Improvesecurity analysis capabilityVSAvoidcomplexity and cost of managing formal models

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Formal models are generated preliminarily at design-time from annotated sequence diagrams, capturing security requirements and threat scenarios before deployment. This preliminary generation allows the complex formal modeling work to be done once during development, rather than repeatedly during testing, reducing overall complexity and cost

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates simplified annotated sequence diagrams that copy and represent the essential security properties of the system behavior. These diagrams serve as manageable representations that can be automatically translated into formal models, allowing security analysis without directly managing the full complexity of formal specifications

Inventive Principle:

Principle #26Copying

3Measurement precision

If security annotations are added to sequence diagrams, then subtle security flaws can be detected, but the design-time analysis becomes more complex

Engineering Contradiction:

Improvedetection of subtle security flawsVSAvoidcomplexity of design-time analysis

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The security annotation process is designed to be self-service through automated tools that guide developers in adding security annotations to sequence diagrams. The system provides templates, predefined security goals, and automatic validation, reducing the manual effort and complexity involved in performing detailed security analysis at design-time

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Annotated sequence diagrams serve as an intermediary representation between the system design and formal security models. They capture security properties in a visual, manageable format that can be automatically translated into formal models, bridging the gap between design-time analysis and runtime verification without requiring direct manipulation of complex formal specifications

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9565201B2Security threat identification/testing using annotated sequence diagrams

Publication Date: 2017.02.07 SAP SE

AI summary

Embodiments provide apparatuses and methods supporting software development teams in identifying potential security threats, and then testing those threats against under-development scenarios. At design-time, embodiments identify potential threats by providing sequence diagrams enriched with security annotations. Security information captured by the annotations can relate to topics such as security goals, properties of communications channels, environmental parameters, and/or WHAT-IF conditions. The annotated sequence diagram can reference an extensible catalog of functions useful for defining message content. Once generated, the annotated sequence diagram can in turn serve as a basis for translation into a formal model of system security. At run-time, embodiments support development teams in testing, by exploiting identified threats to automatically generate and execute test-cases against the up and running scenario. The security annotations may facilitate detection of subtle flaws in security logic, e.g., those giving rise to Man-in-the-middle, authentication, and/or confidentiality issues in software under-development.