Software architectures are not only the foundation on which software systems are built, but also provide a basis for reasoning about system properties, such as security, even before the first line of code is written. A software architecture is shaped by a set of design decisions made by architects. For a given design problem, multiple decisions are often possible, and selecting any one of them leads to a different design alternative, each of which introduces a different attack surface. Despite the significant impact of architectural design decisions on the security of the implemented system, a systematic method for assessing security during the architecture design stage remains an open challenge. To improve support here, we propose a metamodel extension to an existing architectural description language, in order to include the security zones of the system, i.e., modeling where system users can interact with the deployed system. We utilize this information to propose a new approach for generating abstract penetration test cases for scenarios in which the boundaries between zones are crossed. In this paper, we consider information-flow analysis as a concrete application area of security assessment. Consequently, a zone crossing in this context corresponds to a location where confidential information might be leaked. The generated test cases can then be used to detect potential leakage of confidential information, either at design time or during late penetration testing, once the system is deployed. We evaluate the approach using the Goal-Question-Metric (GQM) method across five case studies, considering usefulness, effort reduction, and performance. The results indicate that the generated abstract penetration test cases (APTCs) are mostly useful for architecture-level security assessment and can guide later penetration testing, while supporting effort reduction and requiring only low runtime overhead.

Software architecture models capture early design decisions that strongly influence system quality attributes, including security. However, architecture-level security assessment and feedback are often absent in practice, allowing security weaknesses to propagate into later phases of the software development lifecycle and, in some cases, to remain undiscovered, ultimately leading to vulnerable systems. In this paper, we bridge this gap by proposing the generation of Abstract Penetration Test Cases (APTCs) from software architecture models as an input to support architecture-level security assessment. We first introduce a metamodel that defines the APTC concept, and then investigate the use of large language models with different prompting strategies to generate meaningful APTCs from architecture models. To design the APTC metamodel, we analyze relevant standards and state of the art using two criteria: (i) derivability from software architecture, and (ii) usability for both architecture security assessment and subsequent penetration testing. Building on this metamodel, we then proceed to generate APTCs from software architecture models. Our evaluation shows promising results, achieving up to 93% usefulness and 86% correctness, indicating that the generated APTCs can substantially support both architects (by highlighting security-critical design decisions) and penetration testers (by providing actionable testing guidance).

Context: Software systems often provide critical functionality or process personal data, requiring compliance with applicable legal regulations. Ensuring legal conformity demands close collaboration between legal and technical experts, but differences in terminology and methodology make this challenging. Objective: In this article, we aim to address the challenges in legal interdisciplinary collaboration by proposing a model-based workflow for ongoing and collaborative legal assessments within the context of threat modeling. Method: The central aspects of the workflow are based on model-driven engineering techniques and were developed through active collaboration between researchers in software engineering and legal informatics/data protection at the KASTEL Security Research Labs. The goal of the collaboration was to integrate the methodologies of both domains into the workflow equally. Result: The proposed workflow centers on maintaining consistency between a legal viewpoint and data flow diagrams, addressing legal subsumption, allowing each discipline to work from its own perspective while providing automated support in threat identification through an extended existing data flow analysis framework that considers legal interpretation. We evaluate the workflow and its modeling artifacts by applying it in the domain of the GDPR, discussing feasibility and applicability, and measuring the accuracy and scalability of the extended data flow analysis. Conclusion: By combining discipline-specific viewpoints with automated consistency and threat identification, the workflow supports collaboration and enables iterative assessments. Our findings suggest that the presented workflow is suitable and operationalizable, but identify potential challenges in practical application or transfer to other legal domains.

Building systems that do not violate confidentiality of data through accidental information leakage is an increasingly important challenge. This is especially true for security-critical systems that handle sensitive information. A well-known obstacle for building secure systems is that security properties, such as confidentiality, are only addressed in late development phases. To combat this, information flow control by-construction (IFbC) was proposed. Similarly to correctness-byconstruction for functional correctness, it aims at building systems such that they have a secure information flow by-construction. This paper presents an extension of that work in which we scale IFbC to the software architectural level for component-based systems. Our approach allows software architects to create a high-level design of the system using UML component models with explicit provided and required interfaces. We provide information flow specifications for the interfaces of components, which integrates the security concerns of the system in the design phase. We then demonstrate how the individual components can be realized according to information flow control by-construction, such that they adhere to their interface specifications. We provide rules for compatibility of interfaces and implementations that ensure confidential information flow, and prove that all component-based systems that can be constructed by our approach satisfy their security properties. In this way, we allow flexible architectural modeling of component-based systems combined with strong confidentiality guarantees from information flow control by-construction. Finally, we present the tool ArchFlow which assists developers with creating secure component-based systems.

More and more legal norms directly target software-based systems. Although these norms often require some form of legal assessment, such as the data protection impact assessments mandated by the General Data Protection Regulation, they are usually conducted in separated steps before or after development. As legal norms translate to requirements of the system to be developed, they have a profound influence on the software design and architecture, which makes subsequent changes cost intensive. Therefore, it should be ensured that software architects are provided with knowledge that supports them in designing legally compliant systems. In this paper, we derive challenges for legal knowledge transfer and discuss how we address them. As an initial approach, we define a metamodel for structured legal comments and present a first attempt to automatically annotate them within data flow diagrams. The approach is demonstrated with an example system in a real-world legal context, illustrating why supported knowledge transfer is necessary.

Kconfig is a prominent configuration system that helps manage variability of software such as the Linux kernel. To make such software accessible to feature-oriented analysis, it is desirable to transform Kconfig into equivalent feature models. In this paper, we address the problem that existing transformations do either not cover an essential part of the Kconfig language constructs, or fail to produce human-readable feature models. We address both limitations by drawing up practical guidelines for the transformation, and enable feature-oriented analysis in terms of Kfeature as a tool interface of the FeatureIDE framework. To evaluate the semantic equivalence, we apply Kfeature to synthesized variability definitions.

The growing interconnection between software systems increases the need for security already at design time. Security-related properties like confidentiality are often analyzed based on data flow diagrams (DFDs). However, manually analyzing DFDs of large software systems is bothersome and error-prone, and adjusting an already deployed software is costly. Additionally, closed analysis ecosystems limit the reuse of modeled information and impede comprehensive statements about a system's security. In this paper, we present an open and extensible framework for data flow analysis. The central element of our framework is our new implementation of a well-validated data-flow-based analysis approach. The framework is compatible with DFDs and can also extract data flows from the Palladio architectural description language. We showcase the extensibility with multiple model and analysis extensions. Our evaluation indicates that we can analyze similar scenarios while achieving higher scalability compared to previous implementations.

Artificial intelligence can revolutionize scientific projects, but scientists face challenges in reusing, integrating, and deploying cost-effective and high-quality machine learning solutions. Determining suitable algorithms and parameters is difficult, especially for non-programmer scientists. Some algorithms, like deep learning-based methods, offer flexibility but require extensive training on annotated data. This poses a hurdle in labor-intensive tasks like biological image segmentation that relies on expert annotations.In this paper, we present a data-driven framework designed to assist scientists in selecting, reusing, and training machine learning solutions for microscopy image segmentation. The framework is based on establishing a mapping between object morphology features and the optimal segmentation algorithms and settings for individual objects. This mapping is iteratively refined through a combination of unsupervised learning and active learning iterations. To expedite convergence, objects are initially clustered based on their morphology. In each active learning iteration, the most informative and uncertain samples are selected and queried within a specific cluster. Through a biological case study, we demonstrate that our method enables the selection and training of segmentation algorithms specific to object types. Additionally, the selective requests for user input significantly reduce the number of user interactions required for this task.

Information flow security is not guaranteed to be preserved when a system is being composed of secure components. Whereas asynchronous communication is known to mitigate this problem in principle, the concrete impact of specific communication models on composability has not been investigated so far. We address this problem by formalizing seven asynchronous communication models from the literature in the Uppaal environment. On this basis, we capture a negative example, where information flow security is not composable, and contrast it with the formalized communication models to investigate their impact on composability. Our investigation shows that six out of seven asynchronous communication models ensure composability of information flow security.

Zero Trust is considered a powerful strategy for securing systems by emphasizing distrust of all resource access requests. There are different approaches to integrating ZTAs into a system, differing in their components, assembly, and allocation. Early evaluation and selection of the right approach can reduce the costs of resources. In this paper, we propose a novel zero trust architecture (ZTA) metamodel based on literature and industry applications. We introduce our proposed metamodel elements and provide a model instance using the Palladio Component Model (PCM). We describe the requirements for enabling two existing approaches to performance simulation and security data flow analysis on the architectural level and outline how we realize them in our PCM-based implementation. Our evaluation demonstrates the applicability of our ZTA metamodel. It can represent real-world ZTA approaches in various domains, enabling the simulation of performance impact and analysis of the correct implementation of zero trust principles at the architectural level.

Through the increasing interconnection between various systems, the need for confidential systems is increasing. Confidential systems share data only with authorized entities. However, estimating the confidentiality of a system is complex, and adjusting an already deployed software is costly. Thus, it is helpful to have confidentiality analyses, which can estimate the confidentiality already at design time. Based on an existing data-flow-based confidentiality analysis concept, we reimplemented a data flow analysis as a Java-based tool. The tool uses the software architecture to identify access violations based on the data flow. The evaluation for our tool indicates that we can analyze similar scenarios and scale for certain scenarios better than the existing analysis.

The protection of personal data has become an increasingly important issue. Legal norms focused on data protection, such as the EU General Data Protection Regulation (GDPR), provide legally binding requirements for systems that process personal data. Article 25 of the GDPR refers to the obligation to Data Protection by Design and Default. This can be achieved by conducting legal assessments of the system in the early stages of development and implementing data protection concepts where necessary. This ties in with Article «5, which refers to an obligation to conduct legal assessments before the actual processing of data. To aid in conducting continuous legal assessments during the design time of software systems, we propose a model-based collaboration framework. This framework not only aids in providing consistent views of the software system for legal experts and software architects but also simplifies communication between both parties. We discuss the overall goals and benefits of such a framework and go into detail about the processes that interact as part of the framework. We also try to align legal concepts with the processes and describe the continuous iterative development using the collaboration framework.

Developers of model transformations are often required to produce verbose transformation definitions. This verbosity results from the need to link the elements of the target model explicitly by initializing their features, which requires developers to handwrite large amounts of repetitive transformation instructions. Whereas existing hybrid transformation languages automate the application of rules, they do not save developers from these boilerplate instructions. In this paper, we demonstrate that a large fraction of such instructions can be intelligently inferred from a set of simple mappings between the source and target types of a transformation. On this basis, we propose a heuristic inference mechanism to augment such type mappings with additional mappings for the initialization of features, thereby saving developers from the need to handwrite boilerplate instructions. We showcase the ability of our mechanism to reduce the verbosity of transformations using four case studies.

Since cyber-physical systems are inherently vulnerable to information leaks, software architects need to reason about security policies to define desired and undesired information flow through a system. The microservice architectural style requires the architects to refine a macro-level security policy into micro-level policies for individual microservices. However, when policies are refined in an ill-formed way, information leaks can emerge on composition of microservices. Related approaches to prevent such leaks do not take into account characteristics of cyber-physical systems like real-time behavior or message passing communication. In this paper, we enable the refinement and verification of information-flow security policies for cyber-physical microservice architectures. We provide architects with a set of well-formedness rules for refining a macro-level policy in a way that enforces its security restrictions. Based on the resulting micro-level policies, we present a verification technique to check if the real-time message passing of microservices is secure. In combination, our contributions prevent information leaks from emerging on composition. We evaluate the accuracy of our approach using an extension of the CoCoME case study.

Model-based systems engineering provides a multi-disciplinary approach to developing cyber-physical systems. Due to their high degree of interconnection, security is a key factor for cyber-physical systems and needs to be front-loaded to the beginning of the development. However, there is a lack of model-based systems engineering approaches that enable the early specification of security policies. As a consequence, security requirements frequently remain unspecified and therefore are hard to satisfy in the downstream development phases. In this paper, we propose to integrate model-based systems engineering with the theory of information flow security. We extend systems engineering models to information flow policies, enabling systems engineers to specify the information flow security requirements of a system under development. On refinement of the resulting models, our approach allows to derive security requirements for individual software components. We illustrate our approach using a model-based design of an autonomous car.

A key challenge of component-based software engineering is to preserve extra-functional properties such as security when composing the software architecture from individual components. Previous work in this area does not consider specific characteristics of cyber-physical systems like asynchronous message passing, real-time behavior, or so-called feedback composition with two-way communication. Thereby, a composition of secure components might lead to insecure architectures with undetected information leaks. In this paper, we address the preservation of information flow security on composition of cyber-physical systems, taking the above characteristics into account. We refine security policies during the architectural decomposition, and outline a compositional verification approach that checks the security of individual components against their refined policies. On composition of secure components, our approach preserves security and thereby enables the design of secure software architectures. We give a proof of concept using a component-based software architecture of a cyber-manufacturing system.

Engineering cyber-physical systems secure by design requires engineers to consider security from the ground up. However, current systems engineering processes are not tailored to cyber-physical systems, or lack an integration with security engineering. In this paper, we integrate secure software engineering practices into an engineering process for cyber-physical systems. Thereby, we enable engineers to specify security requirements at the level of systems engineering, and to take effective countermeasures during both platform-independent and platform-specific software engineering. Our key contribution is the integration of threat models for tracing security requirements to countermeasures. We illustrate our approach by an autonomous car with high security requirements.

Model of a cyber-manufacturing system for the UPPAAL model checker, including a mitigation of a timing channel.