Skip to main content


Run-time security traceability for evolving systems


Andreas Bauer, Jan Juerjens and Yijun Yu


Australian National University

TU Dortmund

Fraunhofer ISST

The Open University


Security-critical systems are challenging to design and implement correctly and securely. A lot of vulnerabilities have been found in current software systems both at the specification and the implementation levels. This paper presents a comprehensive approach for model-based security assurance. Initially, it allows one to formally verify the design models against high-level security requirements such as secrecy and authentication on the specification level, and helps to ensure that their implementation adheres to these properties, if they express a system’s run-time behaviour. As such, it provides a traceability link from the design model to its implementation by which the actual system can then be verified against the model while it executes. This part of our approach relies on a technique also known as run-time verification. The extra effort for it is small as most of the computation is automated; however, additional resources at run-time may be required. If during run-time verification a security weakness is uncovered, it can be removed using aspect- oriented security hardening transformations. Therefore, this approach also supports the evolution of software since the traceability mapping is updated when refactoring operations are regressively performed using our tool-supported refactoring technique. The proposed method has been applied to the Java-based implementation J ESSIE of the Internet security protocol SSL, in which a security weakness was detected and fixed using our approach. We also explain how the traceability link can be transformed to the official implementation of the Java Secure Sockets Extension (J SSE) that was recently made open source by Sun.

BibTeX Entry

    journal          = {The Computer Journal},
    author           = {Bauer, Andreas and Juerjens, Jan and Yu, Yijun},
    number           = {1},
    month            = jul,
    volume           = {54},
    year             = {2011},
    keywords         = {run-time verification, monitoring, it security, cryptographic protocols, formal verification,
                        security analysis, software evolution, requirements traceability},
    title            = {Run-Time Security Traceability for Evolving Systems},
    pages            = {58--87}


Served by Apache on Linux on seL4.