Int
ern
at
i
onal
Journ
al of Ele
ctrical
an
d
Co
mput
er
En
gin
eeri
ng
(IJ
E
C
E)
Vo
l.
8
,
No.
6
,
D
ece
m
ber
201
8
, pp.
5278
~
52
91
IS
S
N:
20
88
-
8708
,
DOI: 10
.11
591/
ijece
.
v
8
i
6
.
pp
5278
-
52
91
5278
Journ
al h
om
e
page
:
http:
//
ia
es
core
.c
om/
journa
ls
/i
ndex.
ph
p/IJECE
A
UM
L
Profile
f
or Secur
ity and
Code Ge
neration
A
bdell
ati
f
L
asbah
an
i
,
M
osta
fa
Chhi
ba
,
A
b
delm
ou
me
n
T
abyaoui
RMI L
abor
a
tor
y
,
FS
TS
Hass
an
1
st
Univer
si
t
y
,
Morocc
o
Art
ic
le
In
f
o
ABSTR
A
CT
Art
ic
le
history:
Re
cei
ved
J
un
23
, 2
01
7
Re
vised
Ju
l
28
,
201
8
Accepte
d
Aug
11
, 201
8
Rec
en
tly
,
m
an
y
rese
arc
h
studies
have
suggested
the
int
egr
a
ti
o
n
of
safe
t
y
engi
ne
eri
ng
at
a
n
ea
rl
y
stage
of
m
odel
ing
and
s
y
stem
deve
lop
m
ent
using
Model
-
Drive
n
Archi
tectur
e
(
M
DA
).
Thi
s
concept
consists
in
d
epl
o
y
ing
th
e
UM
L
(Unifie
d
Modeli
ng
L
angu
age
)
st
anda
rd as
apr
incipal m
et
a
m
odel
for
the
abstra
c
ti
ons
of
d
iffe
ren
t
s
y
s
te
m
s.
To
our
knowle
dge,
m
ost
of
this
work
has
foc
used
on
in
te
g
rat
ing
se
cur
i
t
y
r
equi
rement
s
aft
e
r
the
implemen
t
at
ion
ph
ase
without
t
aki
ng
t
hem
int
o
a
cc
oun
t
when
design
in
g
s
y
stems
.
In
this
work,
we
foc
used
our
e
ff
orts
on
non
-
fun
ct
ion
al
asp
ec
ts
such
as
the
business
logi
c
lay
er
,
da
ta
f
low
m
onit
oring,
and high
-
qual
i
t
y
serv
ic
e
d
eliver
y
.
Pra
ct
i
ca
l
l
y
,
we
have
proposed
a
new
UM
L
profil
e
for
se
cur
ity
in
te
gr
at
io
n
and
code
gene
ra
ti
on
for
t
he
Java
pl
at
for
m
.
The
ref
or
e,
th
e
sec
uri
t
y
prope
rti
es
will
b
e
desc
ribe
d
b
y
a
UM
L
profil
e and
t
he
OCL
la
ngu
ag
e
to
ver
i
f
y
the
r
e
quire
m
ent
s
of
conf
id
ent
i
al
i
t
y
,
aut
hori
zatio
n,
av
ai
l
ability
,
data
in
te
gr
ity
,
and
da
ta
enc
r
y
pt
ion.
Fin
al
l
y
,
the
sourc
e
code
such
a
s
the
appl
ication
sec
urity
conf
iguration,
th
e
m
et
hod
sign
atures
and
the
ir
b
odie
s,
the
p
ersis
te
nt
entities
and
th
e
sec
ur
ity
cont
ro
ll
ers
g
en
era
t
ed
from
seq
uenc
e
dia
gr
am
of
s
y
stem’s
int
ern
al
beh
av
io
r
aft
er
it
s
ex
te
n
sion
with
thi
s
p
rofil
e
and
app
l
ying
a
set
of
tra
nsform
at
ions
.
Ke
yw
or
d:
Cod
e
g
e
ner
at
i
on
LOC
MDA
Mod
el
t
ra
nsfo
r
m
at
ion
SD
S
IB
Secu
rity
p
r
of
il
e
Secu
rity
p
r
op
e
rtie
s
SPEM
Copyright
©
201
8
Instit
ute of
Ad
v
ance
d
Engi
ne
eri
ng
and
Sc
ie
n
ce
.
All
rights re
serv
ed
.
Corres
pond
in
g
Aut
h
or
:
Abdell
at
if Las
bah
a
ni,
RM
I
Lab
orat
ory
,
FSTS Hassa
n 1st Uni
ver
sit
y,
26000. Sett
at
, M
orocc
o
.
Em
a
il
:
abb
della
ti
f.
la
sb
ah
ani
@g
m
ai
l.co
m
1.
INTROD
U
CTION
In
t
he
rese
nt
y
ears,
we
witne
ssed
a
fast
te
chnolo
gical
ev
ol
ution
acc
om
pan
ie
d
with
a
m
assive
use
of
IT
ser
vices
tha
t
autom
at
ed
and
facil
it
at
ed
m
any
thin
gs
in
our
daily
li
ves.
A
trem
end
ous
a
m
ou
nt
of
s
oft
ware
app
li
cat
io
ns
a
nd
syst
em
s
are
buil
t
ever
y
day
ar
ound
t
he
w
or
l
d
to
co
ver
the
e
volvi
ng
cust
om
ers’
nee
ds
.
Con
se
quently
,
existi
ng
a
pp
li
cat
ion
s
s
hould
be
update
d
a
nd
e
nhance
d
c
on
sta
ntly
.
For
this
reason,
Mod
el
-
Dr
i
ven
Ar
c
hitec
ture
(M
DA)
has
bee
n
de
ve
lop
e
d
to
pr
ovide
an
in
novat
ive
de
velo
pm
e
nt
process
bas
ed
on
m
od
el
s
.MDA
is
an
init
ia
ti
ve
pro
po
se
d
by
O
bj
ect
Ma
na
ge
m
ent
Gr
ou
p
(
OMG
)
to
pick
up
the
sta
nd
a
r
d
UML
,
wh
ic
h
is
de
ploy
ed
f
or
m
od
el
ing
O
bject
-
Or
ie
nted
Syst
em
s’
desig
n.
MD
A
trie
s
to
c
over
up
the
f
ull
s
of
t
war
e
dev
el
op
m
ent
l
ife
cy
cl
e
sta
rt
ing
f
ro
m
the
incepti
on
phas
e
un
ti
l
the
m
ai
ntenance
or
transiti
on
ph
a
s
e.
In
add
it
io
n,
MD
A
is
a
m
od
el
ing
la
ngua
ge
bas
ed
pri
ncipall
y
on
the
s
or
ti
ng
ou
t
of
preocc
upat
ions
in
the
f
or
m
of
abstracti
on le
ve
ls w
her
e e
ve
r
yone re
pr
ese
nt
s a
diff
e
ren
t
syst
e
m
’s
view
.
The
se
par
at
io
n
of
the
syst
em
m
od
el
s
can
fa
ci
li
ta
te
the
i
m
pro
vem
ent
of
the
no
n
-
functi
onal
aspects
with
s
upplem
e
ntary
sec
ur
it
y
i
nfor
m
at
ion
to
m
ake
it
m
or
e
com
plete
.
Ther
e
fore,
M
D
A
a
ppr
oac
h
prom
otes
the
m
assive
exp
l
oit
of
m
od
el
thro
ug
h
the
w
ho
l
e
so
ftwa
re
de
ve
lop
m
ent
pr
oc
ess
pleadin
g
f
r
om
a
Co
m
pu
ta
ti
on
Inde
pende
nt
Mod
el
(CIM
)
ded
ic
at
e
d
for
r
equ
i
rem
ents
sp
eci
ficat
ion
s
to
cod
e
m
od
el
or
com
po
nen
ts
tr
ansient
by
the
Plat
f
orm
In
dep
e
nd
e
nt
Mod
el
(
PIM
)
an
d
Plat
f
or
m
Sp
eci
fic
Mod
el
(P
SM)
.
Cod
e
ge
ner
a
ti
on
i
s
perform
ed
by
app
ly
in
g
dif
fere
nt
kinds
of
trans
la
ti
on
s
or
trans
f
or
m
at
ion
s:
CIM
to
PI
M,
PI
M
to
PSM,
a
nd
PSM to
sourc
e
cod
e
.
Evaluation Warning : The document was created with Spire.PDF for Python.
In
t J
Elec
&
C
om
p
En
g
IS
S
N:
20
88
-
8708
A U
M
L Pr
ofil
e for
Sec
ur
it
y and C
ode
Ge
ner
ation
(
A
bdel
lat
if
La
s
bahani
)
5279
This
pa
per
pro
vid
es
a
ne
w
m
od
el
-
dri
ve
n
m
et
hodo
l
og
y,
ba
sed
on
MD
A,
al
lowing
the
ge
ner
at
io
n
of
secur
e
s
of
t
ware
app
li
cat
ion
s
with
f
un
ct
io
na
l
and
no
n
-
func
ti
on
al
aspects
after
m
od
el
ing
them
in
the
analy
sis
and
desi
gn
phase.
The
im
plem
entat
ion
ph
a
se
will
be
perf
or
m
ed
usi
ng
Seque
nc
e
Diag
ram
s
of
t
he
Syst
e
m
’sI
nter
na
l
Be
hav
i
or
(SDSIB
),
w
hich
is
us
e
d
f
or
m
od
el
ing
the
syst
e
m
’s
inter
nal
be
ha
vior
f
or
each
syst
e
m
’s
us
e c
ase. In t
his a
ppro
ac
h, S
DS
IB
will
b
e
dep
l
oy
ed
as
PI
M
ge
ne
rated
from
CIM.
This
ap
proac
h
i
m
pr
oves
the
pro
duct
ivit
y
of
desig
ners
and
dev
el
op
e
rs,
a
nd
the
qu
al
it
y
of
serv
ic
e
by
al
lowing
them
to
de
crease
the
desig
n’
s
m
ist
akes
an
d
de
al
with
c
on
s
ecuti
ve
im
pr
ovem
ents,
wh
ic
h
ar
e
pro
du
ce
d
dur
i
ng
the
im
ple
m
entat
ion
phase
.
The
ap
plica
ti
on’s
inter
nal
be
hav
i
or
s
a
re
m
od
el
ed
throu
gh
the
seq
uen
ce
diag
ram
of
syst
em
’s
internal
be
hav
i
or
t
hat
exten
ds
the
sy
stem'
s
fu
nctio
nalit
ie
s.
The
i
nter
nal
beh
a
vior
is
de
velo
ped
t
oget
he
r
with
it
s
m
eta
-
m
od
el
to
il
lustra
te
the
f
ull
transacti
ons
bet
ween
obj
ect
s
duri
ng
the
exec
ution
of
the
us
e
cas
e.
Each
use
case
will
be
ex
te
nd
e
d
with
th
e
secur
it
y
po
li
ci
es
that
are
al
read
y
def
i
ned b
y t
he se
cur
it
y ex
pe
rts at the s
pecifi
cat
ion
ph
a
se.
The
pr
ese
nted
pap
e
r
ai
m
s
to
carry
on
our
e
arli
er
w
orks
by
pro
vid
i
ng
a
Tem
plate
-
Or
ie
nted
C
ode
Gen
e
rato
r
that
al
lows
t
he
ge
ner
at
io
n
of
sec
ur
e
softwa
re
a
pp
li
cat
io
ns
th
r
ough
the
ne
w
appr
oach
that
exten
ds
the
Jav
a
m
et
a
-
m
od
el
and
se
quence
dia
gr
am
m
e
ta
-
m
od
el
to
introd
uce
t
he
secur
it
y
co
nce
pts
int
o
the
m
o
delin
g
and
im
ple
m
ent
at
ion
phase.
In
this
pap
e
r,
we
hav
e
c
ho
se
n
S
DS
IB
as
P
IM
because
we
f
ound
that
this
c
at
egory
of b
e
ha
vio
ral
di
agr
am
s is b
et
te
r
tha
n be
hav
i
or
al
diag
ram
s d
ue
to
it
s c
om
po
sit
ion an
d off
ered ser
vices.
By
app
ly
ing
a
set
of
m
od
el
-
to
-
m
od
el
tran
sf
or
m
at
ion
s,
we
can
ge
ne
rate
autom
at
ic
ally
se
cur
e
obj
ect
-
or
ie
nted
softw
are
ap
plica
ti
on
s
inclu
ding
the
syst
e
m
’s
secur
it
y
infr
a
struct
ur
e,
m
et
hods
an
d
their
bodies
,
per
sist
e
nce
be
ans,
c
onfig
ur
a
ti
on
s
file
s,
sy
nchr
on
iz
at
io
n
ru
le
s,
busines
s
log
ic
co
ntr
ollers,
Da
ta
Acces
s
Objects,
a
nd
s
ecur
it
y
co
ntr
ollers.
T
o
do
th
at
,
our
gen
e
rat
or
us
es
,
as
in
pu
t,
a
n
i
nterm
ediat
e
m
od
el
,
this
is
ob
ta
ine
d
direc
tl
y
fr
om
SD
SIB
after
a
pply
ing
a
set
of
m
od
el
t
ran
sit
io
ns.
S
uch
m
od
el
aim
s
to
get
bette
r
read
a
bili
ty
,
scal
abili
ty
,
reli
a
bili
t
y,
and
re
usa
bili
ty
of
syst
e
m
s
bef
ore
a
nd
a
fter
t
he
im
ple
m
entat
ion
ph
a
se
.
Additi
on
al
ly
,
su
c
h
interm
ediat
e
m
od
el
is
us
e
d
to
m
ake
bigger
t
he
t
arg
et
platfo
rm
with
non
-
f
unct
ion
al
i
m
pr
ovem
ents
or
Cr
os
s
-
c
utti
ng
co
nce
rn
s
,
su
ch
a
s
sec
ur
it
y
poli
ci
es
properti
es,
s
ync
hro
nizat
ion
ru
le
s,
per
sist
e
nce,
or
QOS
co
ns
trai
nt
s.
In
this
wor
k,
w
e
ha
ve
trie
d
to
com
e
tog
e
ther
bet
wee
n
f
un
ct
io
nal
as
pe
ct
and
non
-
f
un
ct
io
nal
aspect
to
con
side
r
the
non
-
functi
onal
pro
per
ti
es
duri
ng
the
an
al
ysi
s,
desig
n,
an
d
the
i
m
ple
m
entat
io
n ph
a
se.
For
e
ac
h
us
e
case,
we
af
f
ect
the
secu
rity
prof
il
e
to
e
nh
a
nce
t
he
sy
stem
’s
us
e
ca
ses
with
t
he
ind
is
pen
sa
ble
per
m
issi
on
s,
s
uch
as
c
onfide
ntial
it
y
ru
le
s,
tracea
bili
ty
const
raints,
an
d
non
-
re
pudiati
on
ru
le
s,
then
eac
h
use
case
will
be
co
nv
e
rted
t
o
S
D
SI
B
to
determ
i
n
e
di
ff
e
ren
t
obj
ect
s
an
d
s
ub
-
operati
ons
par
ti
ci
pan
ts
in the e
xec
utio
n of t
he use ca
se b
y
fo
ll
owin
g
the
n
e
w
m
eanin
g of t
he
L
ar
m
an’
s
Op
e
rati
on Co
ntracts
(
LOC)
.
To
gen
e
rate
secur
e
ob
j
ect
-
or
ie
nted
s
of
t
war
e
a
ppli
cat
ion
s
,
we
hav
e
fo
c
us
e
d
on
scal
abili
ty
,
m
ai
ntain
abili
ty,
and
sa
fety
of
the
syst
e
m
.
We
us
ed
Mo
del
View
Co
ntr
oller
(MVC)
desi
gn
patte
rn
s
al
tog
et
he
r
with
G
rasp
Pa
tt
ern
s
basi
ng
on
SDSIB
el
ab
or
at
io
n
to
fee
d
the
gen
e
rato
r
with
the
ne
w
-
fa
ng
le
d
str
uctur
e
of
syst
e
m
s,
wh
ic
h
ar
e
th
ree
m
ain
s
la
ye
rs:
view
s,
co
ntr
ollers,
and
m
od
el
s.
I
n
this
w
ork
,
the
co
ntr
oller
la
ye
r
will
be
sub
div
id
ed
i
nto
tw
o
c
on
tr
ol
le
rs: Pr
oc
essin
g
Co
ntr
oller (
P
C) and securit
y con
tr
oller (se
c
ur
it
y vali
dato
r) that
will
b
e
ob
ta
i
ne
d
a
uto
m
at
ic
all
y t
hroug
h
the
prop
os
ed
m
et
ho
do
l
og
y.
SD
S
IB
is
gat
h
ered
from
Sequ
ence
Diag
ram
of
Syst
e
m
’s
Exter
nal
Be
ha
vio
r
(SDSEB
)
th
at
rep
re
sent
s
on
ly
the
act
ors
’
eve
nts
an
d
th
e
syst
e
m
’s
resp
onses
.
To
pro
te
ct
each
act
ion
or
m
essage
i
niti
at
ed
by
the
act
or
,
we
sho
uld
ap
pl
y
the
secur
it
y
prop
e
rtie
s
veri
ficat
ion
be
for
e
(p
r
e
c
ond
it
ion
)
,
durin
g,
a
nd
after
(post
c
onditi
on)
the
syst
e
m
’s
ob
j
ect
s
inte
racti
on
s
,
an
d
be
f
ore
the
data
stora
ge
in
the
data
base
by
ap
plyi
ng
the
novel
too
l
s
o
-
cal
le
d
Exte
ns
io
n
P
os
t
-
Pre
Co
nd
it
io
n
La
rm
a
n (EPP
L).
This
pa
per
is
structu
red
as
f
ol
lows
.
Sect
io
n
2
su
m
m
arizes
relat
ed
w
orks.
We
giv
e
a
n
O
verview
of
the
software
de
velo
pm
ent
process
a
nd
sec
uri
ty
eng
inee
rin
g
in
Sect
io
n
3.
W
e
sho
w
th
e
pro
po
se
d
a
ppr
oach
i
n
Sect
ion
4
.
I
n
Sect
ion
5
we
ta
lk
ab
ou
t
the
seq
uen
ce
dia
gr
am
of
syst
e
m
’s
internal
be
hav
i
or.
Re
su
l
ts
and
dis
cus
s
i
on
is gi
ven in
sect
ion
6
.
We
c
oncl
ud
e our
p
a
per in
S
ect
ion
7
.
2.
R
EL
ATED
W
ORKS
In
this
sect
io
n,
we
will
high
li
gh
t
the
crit
ic
al
rev
ie
w
of
previ
ou
s
w
orks
that
inte
gr
at
e
m
on
it
or
in
g
strat
egies
an
d
secur
it
y
aspect
s
into
the
s
of
t
war
e
dev
el
op
m
ent
pr
oc
ess.
sp
eci
fical
ly
,
the
m
os
t
i
m
po
rtant
w
orks
that use
MD
A as a m
et
ho
dolo
gy to
i
nteg
rate
non
-
f
un
ct
io
nal
aspects int
o
t
he
softwa
re
devel
op
m
ent p
r
oc
ess.
In
rece
nt
ye
ar
s,
sig
nifica
nt
pro
gr
ess
ha
s
be
en
m
ade
in
de
velo
ping
sec
uri
ty
te
chn
iq
ues
to
a
ddres
s
grow
i
ng
sec
ur
i
t
y
con
ce
rns
a
nd
perform
ance.
Am
on
g
the
m
os
t
s
uccess
fu
l
and
be
st
-
kn
own
c
on
t
rib
utions
in
t
he
world
,
we
highli
gh
t
work
t
ha
t
is
interest
ed
in
the
co
re
w
ork
of
Mo
del
Dr
i
ven
Sec
uri
ty
(MDS)
t
o
in
te
gr
at
e
secur
it
y
co
ns
i
der
at
io
ns
int
o
the
softwa
re
dev
el
op
m
ent
proces
s
.
First
,
Dav
i
d
Ba
sin
a
nd
al
.
B
asin
D
et
.
al.
In
tr
oduce
M
odel
D
rive
n
Se
cur
it
y
(MD
S)
for
the
first
ti
m
e
to
desig
n
secur
e
softwa
r
e
[
1
]
.
T
o
a
pp
l
y
this
m
et
ho
dolo
gy,
the
sam
e
authors
pro
pose
d
a
so
luti
on
to
ob
t
ai
n
the
ge
ne
rati
on
of
acce
ss
c
on
t
ro
l
poli
ci
es
from
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2088
-
87
08
In
t J
Elec
&
C
om
p
En
g,
V
ol.
8
, N
o.
6
,
Dece
m
ber
201
8
:
5278
-
5291
5280
abstract
aut
hor
iz
at
ion
ru
le
s
th
at
are
wr
it
te
n
in
the
f
or
m
of
const
raints.
I
n
add
it
io
n,
the
pro
posed
a
ppr
oa
ch
is
m
or
e interest
in
g
a
nd f
le
xib
le
at
the sam
e time.
In
Lodde
rsted
t
et.
al.
a
do
m
ai
n
-
s
pecific
la
ngua
ge
(
DS
L
)
cal
le
d
Sec
ur
e
UML
was
de
plo
ye
d
to
ta
ke
into
account
the
se
cur
it
y
vu
l
ner
a
bili
ti
es
and
ris
ks
of
the
gi
ve
n
te
ch
no
l
og
y
in
the
de
velo
pm
ent
pr
oce
ss
[
2
]
.
This
DS
L
is
us
e
d
to
m
od
el
acce
ss
con
tr
ol
poli
ci
es
throu
gh
a
new
vo
c
ab
ular
y
to
annotat
e
UML
m
od
el
s
with
the
inf
or
m
at
ion
ne
eded
f
or
acce
s
s
co
ntr
ol.
H
owever,
this
w
ork
rem
ai
ns
ve
ry
f
ar
f
r
om
a
gen
e
ric
m
et
ho
do
l
ogy
tha
t
su
pp
or
ts
al
l security
prope
rtie
s and
pro
vid
e
s m
echan
is
m
s f
or asses
sin
g
s
us
ta
ina
bili
ty
.
W
it
h
res
pect
to
secu
rity
in
serv
ic
e
-
ori
ented
arch
it
ect
ur
es
,
secur
it
y
obj
ect
ives
ha
ve
bee
n
rep
re
sente
d
with
gr
a
phic
al
no
ta
ti
ons
i
n
business
process
m
od
el
s
in
orde
r
to
t
ran
s
f
or
m
secur
it
y
re
quir
e
m
ents
into
c
oncrete
sec
ur
it
y
poli
ci
es
as
ou
tl
ine
d
in
[
3
]
.
P
racti
cal
ly
,
the
author
s
of
this
stu
dy
hav
e
pu
t
f
orw
ard
a
s
pecific
m
od
el
cal
le
d
Sec
ur
it
y
Po
li
cy
Mo
de
l
(S
PM)
,
whic
h
is
us
ed
to
help
im
ple
m
ent
sec
ur
it
y
r
equ
i
rem
ents
su
ch
as
authe
ntica
ti
on
and
acce
ss
con
t
ro
l.
T
his
work
has
not
bu
il
t
sp
eci
fic
too
ls
to
ge
ne
rate
the
fina
l
cod
e
corres
pondin
g
to
the
secu
ri
ty
obj
ect
ives
and
has
no
c
on
c
rete
f
orm
alis
m
to
descr
i
be
the
sec
ur
it
y
nee
ds
thr
oughout t
he
so
ft
war
e
d
e
vel
op
m
ent pro
ces
s.
Satoh
F
et
.
al.
I
ntr
oduce
a
s
olu
ti
on
al
lo
wing
an
nota
ti
ng
syst
e
m
'
s
m
od
el
s
with
sec
ur
it
y
r
ules
a
bout
authe
ntica
ti
on
[
4
]
.
I
n
this
w
ork,
a
uth
e
ntica
ti
on
sec
uri
ty
poli
ci
es
gen
erate
d
by
a
pp
ly
in
g
W
S
-
Secu
rity
Po
li
cy
sta
nd
a
rd
a
nd
S
ecur
it
y
Infrast
r
uctu
re
M
odel
(
SI
M)
as
a
c
od
e
tem
plate
.
this
la
st
on
e
c
on
t
ai
ns
al
l
secur
it
y
ru
le
s
for
the
ta
rget
pl
at
fo
rm
;
cod
e
tem
plate
was
de
plo
ye
d
t
o
m
a
p
the
busine
ss
m
od
el
s
with
the
secur
it
y
obj
e
ct
ives.
Additi
on
al
ly
, a
n
e
xecu
ta
ble c
orres
pondin
g
t
o
sec
ur
it
y p
oli
ci
es g
e
ner
at
e
d by ap
plyi
ng thi
s code tem
plate.
Satoh
F
,
Yam
aguc
hi
Y
pro
pose
an
ap
proac
h
f
or
gen
e
rati
ng
the
secur
it
y
co
nf
ig
ur
at
io
n
f
or
IBM
WA
S
[
5
]
.
T
his a
pproach
aim
s to
aff
ect
t
he
m
app
in
g be
tween
IBM
WA
S
De
plo
ym
e
nt D
esc
ript
or
(
DD) a
nd
WS
-
S
ecur
it
y
Po
li
cy
thr
ough
a
s
pecific
m
od
el
de
pl
oyed,
wh
ic
h
is
us
e
d
to
en
sure
t
he
ne
cessary
m
appi
ng
betwe
en
business
m
od
el
s
and
secur
it
y
ru
le
s
m
od
el
s;
these
m
od
el
s
al
low
i
ng
transfor
m
ing
secur
it
y
po
li
ci
es
to
var
io
us
s
ecur
it
y
config
ur
at
io
ns
su
c
h
as
IBM
WA
co
nfi
gurat
i
on
.
H
oweve
r,
Ju
e
rj
e
ns
an
d
al
.
[
6
]
pro
pose
a
ne
w
a
ppr
oa
ch
s
o
-
cal
le
d
UMLsec
as a s
olu
ti
on t
o
integ
rate t
he se
cur
it
y aspect
s d
uri
ng the s
oft
war
e
de
velo
pm
ent p
hases
t
hro
ugh
the
pro
posed
guide
in
t
his
w
ork
that
help
dev
el
op
e
rs
whic
h
are
no
t
e
xpert
in
te
rm
of
secur
it
y
to
ta
ke
int
o
account
the
se
cur
it
y
risks
an
d
vulne
rab
il
it
ie
s
in
the
syst
e
m
dev
el
opm
ent
sta
ges.
From
a
pr
act
ic
al
per
s
pe
ct
ive,
the
pro
posed
appr
oach
li
m
i
t
ed
since
it
on
ly
resu
lt
ed
in
the
secu
rity
sp
eci
ficat
io
n
m
od
el
ing
f
or
a
fe
w
pro
per
ti
es
with
ou
t
pro
vid
i
ng
a
m
e
tho
dolo
gy
ad
op
te
d
a
nd
a
ccom
pan
ie
d
by
a
sp
eci
fic
to
ol
for
c
ode
gen
e
r
at
ion
includi
ng the
s
ecur
it
y r
ules ac
cordin
g
t
o
c
hosen plat
form
.
Nex
t
,
a
new
fra
m
ew
ork
so
-
c
al
le
d
SECTET
has
bee
n
pro
po
s
ed
by
[
7
]
f
or
m
on
it
or
i
ng
the
secu
rity
'
eng
i
neer
i
ng
in
par
al
le
l
wit
h
th
e
softwa
re
e
ng
ineerin
g.
T
his
f
ram
ewo
rk
e
xtend
e
d
by
a
s
pec
ific
la
ngua
ge
c
al
le
d
SECTET
-
LP
f
or
def
i
ning
sec
ur
it
y
poli
ci
es
in
the
s
oft
ware
functi
onal
it
ie
s
.
Co
ns
eq
ue
ntly
,
the
a
bs
tract
a
ccess
con
t
ro
l
poli
ci
es
transfor
m
ed
to
X
ACML
code
throu
gh
XAC
ML
sta
nd
ar
d.
Fr
om
a
co
m
par
at
ive
point
of
view
,
this
ap
proac
h
confine
d
t
o
se
cur
it
y
exi
gen
ci
es
declarat
i
on
for
a
fe
w
properti
es
with
ou
t
pro
vid
in
g
a
co
ncr
et
e
form
alis
m
t
o
intr
oduce
t
he
a
ccess
co
ntr
ol
poli
ci
es
duri
ng
syst
e
m
s
dev
el
op
m
ent
proce
s
s.
Als
o,
no
t
ool
m
ade
in p
a
rall
el
for
a
uto
m
at
ing
cod
e g
e
ner
at
io
n f
or
bo
t
h
as
pects f
un
ct
io
nal a
nd
non
-
f
un
ct
io
nal.
Re
gardin
g
co
m
po
nen
t
-
b
ase
d
app
li
cat
ion
se
cur
it
y,
[
8
]
gra
nt
respo
ns
ibil
i
ty
and
per
m
issio
ns
for
the
secur
it
y
ex
per
t
to
set
up
the
high
-
le
vel
secur
it
y
po
li
ci
es.
This
w
ork
pro
po
s
ed
a
sp
e
ci
f
ic
m
idd
le
war
e
cal
le
d
Secu
reMi
dd
l
w
are to
exte
nd
C
ORBA co
m
ponen
t m
od
el
s w
i
th d
if
fer
e
nt n
ec
essary n
on
-
f
un
ct
ion
al
p
r
operti
es as
the
secu
rity
or
r
e
co
nf
i
gurati
on. I
n
a
ddit
ion, secur
it
y
exi
genci
es
sp
eci
fied
o
ve
r
the
P
olicy
Def
i
niti
on
La
ngua
ge
(P
D
L)
a
nd
tr
ansfo
rm
ed
i
mm
ediat
el
y
by
an
open
PMF
Po
li
cy
Ma
nage
m
ent
Fr
am
e
work
.
H
ow
e
ve
r,
this
m
et
ho
dolo
gy
does n
ot
sup
port
a
spe
ci
fic
to
ol f
or
sec
ur
it
y
co
nf
i
gurati
on
ge
ner
at
io
n
a
nd does not
guara
nt
ee
the
su
sta
ina
bili
ty
assessm
ent.
Fr
om
a
pr
act
ic
al
po
int
of
vie
w,
t
his
a
ppro
ac
h
sta
ys
i
m
m
a
ture
to
a
pp
ly
it
to
ot
hers
te
chnolo
gies s
uch as c
ould c
om
pu
ti
ng
,
Mul
ti
-
agen
t sy
ste
m
s,
a
nd m
achine learn
i
ng.
In
s
pite
of
thi
s,
there
no
ge
ner
ic
m
et
ho
do
log
y
f
or
s
ecu
r
it
y
integrati
on
and
c
ode
ge
ne
rati
on
from
PSM,
in
cl
udin
g
gen
e
rici
ty
,
re
-
util
iz
at
ion
,
a
nd
s
us
ta
ina
bili
ty
assessm
ent.
Re
gardin
g
c
ode
gen
e
rati
on,
we
ci
te
d
appr
oach
es
ba
sed
on
Petr
i
-
N
et
s
[
9
]
fo
r
a
uto
m
ating
co
de
gen
e
rati
on
for
funct
io
nal
concerns
.
H
ow
e
ve
r,
this
sta
nd
a
rd
do
e
s
no
t
co
ve
r
the
m
od
el
ing
of
t
he
secu
rity
aspect
of
syst
e
m
’s
m
od
el
ing
and
does
no
t
fo
ll
ow
te
chnolo
gical
adv
a
nces
in
te
rm
of
sec
ur
it
y.
T
her
e
fore,
P
et
ri
-
Nets
ca
nn
ot
be
a
gen
e
ri
c
sta
ndar
d
a
ddressin
g
secur
it
y i
nte
grat
io
n durin
g
al
l
softwa
re
dev
el
op
m
ent pro
ces
s,
incl
ud
i
ng ana
ly
sis, d
esi
gn,
and im
ple
m
ent
at
ion
.
To
the
best
of
knowle
dge,
t
he
m
os
t
i
m
po
r
ta
nt
m
e
tho
dol
og
ie
s
giv
e
n
in
this
top
ic
has
no
t
e
nr
ic
hed
with
a
sp
eci
fic
cod
e
ge
ne
rato
r
for
autom
at
i
ng
c
od
e
gen
e
r
at
ion
by
de
ploy
ing
the
existi
ng
to
ols
to
co
nv
e
rt
syst
e
m
’s
funct
ion
al
it
ie
s
to
t
he
sourc
e
c
od
e
.
For
e
xam
ple
,
Roubi
S
et
.
al
.
present
a
m
od
el
-
dri
ve
n
a
ppr
oa
ch
t
o
gen
e
rate
G
UI
f
or
Ri
ch
A
pp
li
c
at
ion
I
nter
net
by
ex
plo
it
in
g
the
usi
ng
Ecl
ip
se
Mod
el
in
g
F
ram
ewo
rk
f
or
Me
ta
-
Mod
el
in
g,
Q
ue
ry
View
Tra
nsfo
rm
at
ion
for
m
od
el
tra
ns
f
orm
ation
s,
a
nd
Accele
o
for
c
od
e
ge
ner
at
io
n
[1
0
]
.
Howe
ver,
this
work
does
no
t
address
t
he
co
de
ge
ne
rati
on
f
or
both
as
pects
functi
onal
an
d
non
-
f
un
ct
i
on
a
l.
Due
to
m
assive
us
e
of
we
b
se
rvi
ces
in
diff
e
r
e
nt
heter
og
e
ne
ous
platf
or
m
s,
[1
1
]
pro
po
s
e
a
secur
it
y
interact
ive
m
od
el
of
web
ser
vice
base
d
on
W
e
bSp
he
re
an
d
.N
E
T
to
reali
ze
sec
ur
it
y
interact
ion
of
heter
ogeneou
s
Evaluation Warning : The document was created with Spire.PDF for Python.
In
t J
Elec
&
C
om
p
En
g
IS
S
N:
20
88
-
8708
A U
M
L Pr
ofil
e for
Sec
ur
it
y and C
ode
Ge
ner
ation
(
A
bdel
lat
if
La
s
bahani
)
5281
platfo
rm
s.
This
m
od
el
adopt
s
a
ne
w
a
ppr
oa
ch
based
on
pr
e
dicat
e
lo
gic
to
integ
rate
th
e
secu
rity
po
li
ci
es
of
heter
og
e
ne
ou
s
platfo
rm
s
and
us
es
the
int
egr
at
e
d
poli
cy
to
sig
n
t
he
SOAP
m
essage.
Co
ns
e
qu
e
nt
ly
,
the
pro
po
se
d
m
et
ho
d i
s s
pecific f
or w
e
b
se
r
vices an
d
ca
n n
ot be ap
plied t
o other
s
tech
no
l
og
i
es.
As
far
a
s
cl
ou
d
im
ple
m
entat
i
on
is
co
nce
rn
e
d,
te
c
hnologic
al
adv
a
nc
es
in
secu
rity
al
so
ta
rg
et
cl
oud
com
pu
ti
ng
or
cl
oud
a
rch
it
ect
ur
e
to
sec
ure
a
nd
sec
ur
e
t
he
cl
oud
platfo
rm
.
T
o
this
e
nd,
m
uch
wor
k
ha
s
bee
n
done
in
this
di
recti
on,
but
we
are
discuss
i
ng
on
ly
the
m
os
t
i
m
p
or
ta
nt
co
nt
ribu
ti
ons
s
uch
as
[1
2
]
,
wh
ic
h
deal
with
sec
ur
it
y
a
nd
safety
i
n
cl
oud
im
ple
m
entat
ion
by
prov
i
ding
gu
i
da
nce.
us
e
rs
with
cl
oud
an
d
m
ob
il
e
cl
oud
exp
e
rtise
to
he
lp
custom
ers
choose
cl
oud
i
m
ple
m
entat
ion
app
r
opriat
el
y
for
secu
rity
and
safety
con
st
r
ai
nts.
Howe
ver,
this
appr
oach
does
no
t
pro
vid
e
a
m
e
tho
d
f
or
de
scribin
g
t
he
tim
ing
an
d
inte
gr
at
io
n
ph
a
se
of
t
he
secur
it
y archit
e
ct
ur
e, a
nd
does
n
ot p
r
ovide a sp
eci
fic too
l f
or g
ene
rati
ng cloud im
ple
m
entat
ion
f
r
om
the
cl
oud
arch
it
ect
ure.
In
this
c
urre
nt
work,
we
c
omplet
ed
our
prev
iou
s
w
orks
gi
ve
n
on
this
t
op
i
cby
m
on
it
or
in
g
data
fl
ows
durin
g
t
he
e
xc
hangin
g
of
m
e
ssages
bet
wee
n
s
of
t
war
e
’s
c
om
po
ne
nts
fi
r
stl
y
and
i
ncr
e
asi
ng
the
num
ber
of
secur
it
y
pro
pert
ie
s
add
resse
d.
In
this
w
ork,
SD
S
IB
was
c
hose
n
as
a
PI
M
instea
d
of
com
m
un
ic
at
ion
diagr
am
[13
]
-
[
17
]
with
the
ai
m
to
ap
ply
the
ne
w
s
e
m
antic
s
of
th
e
secu
rity
duri
ng
the
el
ab
or
a
ti
on
of
the
sof
tware
op
e
rati
ons
i
n
t
he
goal
to
a
pply
the
ne
w
s
e
m
antic
s
of
t
he
sec
ur
it
y
du
ring
the
el
ab
ora
ti
on
of
t
he
s
of
tware
op
e
rati
ons.
We
ha
ve
i
m
plem
ented
our
m
e
thodo
l
og
y
to
a
ddress
ser
vice
qu
al
it
ie
s,
inclu
ding
the
gener
al
iz
at
ion
of
autom
at
ion
in
al
l
aspects,
reduce
d
ap
plica
ti
on
de
velo
pm
ent
costs,
decr
ease
d
m
ain
te
na
nce
cost
s,
an
d
su
sta
ina
bili
ty
assessm
ent.
The
ne
w
sy
ntax
w
as
obta
in
ded
f
r
om
LOC
I
n
order
to
im
pr
ove
SDSIB with
the w
ay
of
e
xc
hangin
g
m
e
ssages
bet
w
een
s
of
tw
are
c
om
po
ne
nts,
thi
s
sem
antic
s
feed
s
UML
with
pr
eci
se
sem
antic
s
to
facil
it
at
e cod
e
gen
e
rati
on acc
ordin
g
t
o
the
c
ho
s
en
p
la
tf
or
m
.
This
pa
per
is
unde
rwrit
te
n
in
secu
rity
engi
neer
in
g
an
d
m
od
el
-
dr
ive
n
eng
i
neer
i
ng,
w
hich
ai
m
s
to
cop
e
with
the
increasi
ng
rise
of
the
I
nter
net
of
T
hings
su
c
h
as
ob
j
ect
s
,
co
m
po
nen
ts,
ag
e
nts
or
W
e
b
ser
vices.
This
MD
A
-
ba
sed
co
ntri
bu
ti
on
a
nd
the
U
ML
prof
il
e
th
at
ext
ends
the
interm
ediat
e
m
od
el
with
secur
it
y
const
raints;
this
ty
pe
of
m
od
el
is
us
ed
to
al
l
ow
platfo
rm
sc
al
abili
ty
co
m
p
ared
to
oth
er
e
nh
a
ncem
ents
t
hat
ca
n
no
t
be
f
or
m
at
t
ed
with
t
he
sy
stem'
s
m
od
el
in
g
la
ngua
ges
a
nd
t
o
im
pr
ove
t
he
s
oft
war
e
ar
chite
ct
ur
e
be
fore
th
e
i
m
ple
m
entat
io
n ph
a
se.
3.
O
VER
VIEW
OF THE
SOF
TWARE
D
E
V
EL
OPMENT
PRO
CESS
AND SEC
U
RIT
Y
ENGI
NEERI
NG
A
UTO
M
ATIO
N
In
this
sect
io
n,
we
pr
e
sent
a
n
over
view
of
the
Larm
an
’so
pe
rati
on
co
ntract
s
an
d
the
s
ynta
x
of
the
secur
it
y
c
on
st
r
ai
nts.
We
s
ho
w
the
S
DS
IB
m
et
a
-
m
od
el
an
d
the
var
io
us
im
pr
ov
em
ents
t
hat
ha
ve
bee
n
m
ade
ov
e
r
the
S
D
SIB
to
ta
ke
i
nto
acco
un
t
t
he
s
ecur
it
y
sem
ant
ic
s
of
secu
rity
pro
per
ti
es
dur
ing
flo
w
inte
ra
ct
ion
s
betwee
n
softw
are
com
po
ne
nt
s.
W
e
desc
ribe
the
m
os
t
i
m
p
or
ta
nt
transfo
r
m
at
ion
s
perfor
m
ed
to
i
m
pr
ove
ou
r
interm
ediat
e
m
od
el
of
the
cho
se
n
platf
or
m
with
secur
it
y
const
raints
su
c
h
as
authe
ntica
ti
on
ru
le
s,
auth
or
iz
at
io
n r
ules, i
ntegr
it
y r
ules,
data e
ncry
ption
r
ules.
3.1.
O
ver
view
o
f
L
arm
an
’s
O
per
at
i
on
Contr
ac
t
s
A
Larm
an’
s
Op
e
rati
on
Co
ntract
s
(L
OC
)
[18]
desc
ribe
the
sta
te
of
th
e
syst
e
m
bef
ore
an
d
afte
r
receivin
g
or
ca
ll
ing
on
syst
e
m
co
m
po
nen
ts
by
syst
em
acto
rs
.
F
ro
m
a
se
m
antic
po
int
of
vie
w,
L
O
C
de
scribe
how
the
c
om
po
ne
nts
of
the
syst
e
m
coo
pe
r
at
e
with
each
oth
e
r
to
res
po
nd
t
o
re
qu
e
sts
by
determ
ining
t
he
diff
e
re
nt
ob
j
ec
ts
involve
d
i
n
t
he
e
xecu
ti
on
of
the
data flo
w.
This
c
ontract
d
efi
nes
al
l
c
ollaborat
io
ns
to
e
xecu
te
the
re
quest
ed
us
e
ca
se.
c
on
diti
on
an
d
po
st
-
co
nd
it
io
n.
From
a
log
ic
al
po
i
nt
of
vie
w,
G
raig
Larm
an
was
interest
ed
in
th
e
internal
beha
viors
of
the
sy
stem
throu
gh
t
he
def
i
niti
on
of
the
sta
te
of
the
syst
e
m
bef
ore
and
after
t
he
e
xec
ution
of
t
he
r
equ
e
st
in
orde
r
to
buil
d
the
desig
n
of
the
syst
e
m
.
In
t
he
pre
-
c
onditi
on,
LOC
descr
i
bes
the
init
ia
l
syst
e
m
.
s
ta
te
,
wh
il
e
the
po
st
-
co
ndit
ion
descr
i
bes
the
s
ta
te
of
the
syst
e
m
after
com
pleti
on
of the
query.
Sp
eci
fical
ly
,
G
raig
fo
c
us
e
d
on
the
sta
te
of
the
syst
em
by
descr
i
bing
m
a
ny
thin
gs
s
uc
h
as
create
d
obj
ect
s,
d
est
r
oy
ed
obj
ect
s,
f
orm
ed
and
br
oken
ass
ociat
ions,
an
d
cha
nges
in
the
sta
te
of
at
tribu
te
s
a
fter
the
execu
ti
on
of
th
e
query.
I
n
th
e
pre
-
c
onditi
on,
Grai
gLa
rm
an
was
a
ddresse
d
to
the
syst
e
m
sta
te
befor
e
rea
chin
g
the
requeste
d
com
po
ne
nt.
From
a
safety
po
int
of
v
ie
w
,
Gr
ai
g
does
not
descr
ibe
t
he
sta
te
of
the
syst
e
m
i
n
te
rm
s
of
safety
and
sust
ai
nab
i
li
ty
assess
m
ent.
Sem
antic
ally,
secur
it
y
ru
le
s
are
not
retriev
ed
be
fore
an
d
afte
r
the
com
pleti
o
n
of
the
ta
r
get
resour
ce.
T
he
old
LOC
doe
s
no
t
co
rr
ect
ly
and
secu
rely
determ
ine
the
m
ai
n
obj
ect
s
or com
pone
nts in
volv
ed
in
ex
ec
utin
g re
qu
est
s
fro
m
syst
e
m
actors.
To
do
this,
we
pr
op
os
e
d
an
e
xtensi
on
of
thi
s
con
tract
to
be
com
e
ver
sat
ile
and
co
ve
r
secur
it
y
issues
at
the
sam
e
tim
e.
Ther
e
for
e,
the
sem
antics
of
sec
ur
it
y
poli
ci
es
desc
ribe
d
by
sec
uri
ty
exp
e
rts
w
il
l
be
consi
der
e
d
in
t
he
ne
w
de
finiti
on
of
L
OC
to
se
m
antic
al
l
y
cov
e
r
them
in
the
sta
te
of
th
e
syst
e
m
bef
ore
an
d
after
the
e
xec
ution
of
the
proces
s.
Like
t
hat,
we
i
nteg
r
at
ed
the
sec
uri
ty
pr
operti
es
durin
g
the
s
of
tware
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2088
-
87
08
In
t J
Elec
&
C
om
p
En
g,
V
ol.
8
, N
o.
6
,
Dece
m
ber
201
8
:
5278
-
5291
5282
dev
el
op
m
ent
proces
s.
Durin
g
the
e
xtensi
on
of
LOC;
we
be
nef
it
ed
f
ro
m
the
be
nef
it
s
of
th
e
MDA
ap
proa
ch
t
o
reduce
desig
n err
or
s
and
vuln
erab
il
it
ie
s.
Tha
nk
s
to
L
O
C'
s
new
se
m
antic
s,
we
can
safely
dr
aw
a
nd
gen
e
rate
al
l
the
interact
ion
s
betwee
n
the
syst
e
m
co
m
po
nen
ts
i
nvolv
e
d
in
co
ns
tr
uctin
g
the
respo
ns
e.
Pr
act
ic
al
ly
,
SD
SI
B
has
bee
n
dr
a
gged
on
th
e
basis
of
t
he
n
ew
LO
C
def
i
niti
on
,
a
nd
the
Object
Con
st
raint
La
ngua
ge
(O
CL
)
us
e
d
to
desc
ribe
the
co
ns
trai
nts
of
secur
it
y
poli
ci
es.
SDSIB
c
onstr
uction
will
be
base
d
on
GRASP
patte
r
ns
to
facil
it
at
e
the
assig
nm
e
nt
of
respo
ns
ibil
it
ie
s to partic
ipa
nts
involve
d
i
n
t
he
ex
ec
utio
n
of
us
e case
s
.
3.2.
O
ver
view
of P
re
-
Po
st C
on
di
tion
Ex
tension
In
t
his
sect
io
n,
we
hav
e
e
xte
nded
t
he
pr
e
-
po
st
conditi
on
of
LARMA
N
to
introd
uce
an
d
validat
e
the
pro
per
ti
es
of
s
ecur
it
y
poli
ci
es
su
c
h
as
a
uthorizat
io
n,
a
uthe
ntica
ti
on
,
dat
a
integrity
,
data
encr
y
ption
a
nd
non
-
repu
diati
on
w
he
n
de
velo
ping
op
e
rati
ng
co
ntr
act
s.
The
m
ai
n
purpose
of
thi
s
extensio
n
is
to
inj
ect
the
sec
ur
it
y
const
raints,
du
rin
g
the
ch
a
ng
e of stat
e of t
he
syst
e
m
, w
he
n an acti
on is
tri
gg
e
re
d by an
a
ct
or
.
This
ne
w
sem
antic
s
of
L
OC
al
lows
de
sig
ne
rs
to
dr
a
w
a
secur
e
SDSIB
in
w
hich
we
de
sign
at
e
al
l
interact
ions
be
tween
i
nteracti
ng
ob
j
ect
s
t
o
r
esp
ond
t
o
inc
om
ing
re
quest
s.
Thes
e
im
pr
ov
e
m
ents
re
du
ce
desig
n
error
s
an
d
im
pro
ve
desig
n
qu
al
it
y.
I
n
othe
r
words,
we
gu
a
ra
ntee
that
source
an
d
t
arg
et
obj
ec
ts
interac
t
secur
el
y a
nd r
e
sp
ect
the
secu
r
it
y con
strai
nts
def
i
ned in t
he UML
prof
il
e.
In
this
exte
ns
i
on,
we
ha
ve
inco
r
porated
th
e
GRAS
P
patte
rn
s
afte
r
their
extensio
n
to
distrib
ute
the
assignm
ent
of
ta
sk
s
on
the
s
yst
e
m
ob
j
ect
s.
It
is
us
ed
to
init
ia
li
ze
the
pr
erequisi
te
s
of
t
he
init
ia
l
sta
te
of
the
syst
e
m
an
d
to d
escri
be
the st
at
e o
f
the syst
em
after
execu
ti
on
of
the
us
e c
ase po
stc
onditi
on
s
. W
e
us
e
d
OCL to
enh
a
nce
syst
e
m
fu
nctio
nalit
y
with
secu
rity
po
li
ci
es;
pr
e
conditi
on
a
nd
po
stc
onditi
on.
Conver
sel
y,
th
e
ne
w
sem
antic
s
of
LOC
al
lows
de
ve
lop
e
rs
to
secu
rely
con
cl
ude
the
va
rio
us
ope
rati
on
s
incl
ud
i
ng
s
ource
an
d
ta
rg
et
obj
ect
s
pa
rtic
ipati
ng
i
n
each
interact
ion.
V
ia
a
sp
eci
fic
cod
e
ge
ner
at
or
,
we
autom
at
icall
y
gen
erate
s
yst
e
m
op
e
rati
ons c
ode along
with t
he
ir secu
rit
y p
olici
es.
3.3.
Ov
er
view
of E
xt
e
nded Pr
e
co
ndition
In
t
he
e
xten
de
d
pre
c
onditi
on,
we
i
ntr
oduce
d
the
secu
rity
po
li
ci
es
co
ns
tr
ai
nts
ve
rificat
ion
t
o
c
hec
k
syst
e
m
’s
sta
te
i
n
te
rm
o
f
secu
r
it
y such
as au
t
horizat
ion, aut
hen
ti
cat
io
n,
a
nd d
at
a inte
gr
it
y bef
or
e c
o
ntinui
ng
to
achieve
syst
em
'
us
e
cases.
To
pro
du
ce
se
cur
e
softwa
re
app
li
cat
io
ns
,
it
is
rec
omm
en
ded
to
desc
rib
e
the
sem
antic
s
of
the
secu
rity
poli
ci
es
durin
g
the
softwa
re
’
arc
hitec
ture
desig
n
to
fa
ci
li
ta
te
UML
prof
il
e
app
li
cat
io
n
on
the
interm
ediat
e
m
od
el
.
O
ur
m
et
ho
do
l
og
y
app
li
ed
t
o
th
e
existi
ng
s
oft
war
e
de
velo
pm
ent
m
et
ho
dolo
gies
li
ke
U
P
-
UX
f
or
e
xte
nd
i
ng
th
e
m
in
the
go
al
to
co
ns
i
der
both
the
f
un
ct
i
on
a
l
and
no
n
-
func
ti
on
al
aspects
at
the
sam
e
tim
e
du
ring
the
syst
em
desig
n.
Af
te
r
be
ing
exte
ndin
g
the
SD
S
IB
with
t
he
UML
pr
of
il
e,
we
a
pp
ly
ou
r
pro
posed
to
ol
or
co
de
ge
ne
rato
r
to
ge
ner
at
e
t
he
co
de
f
r
om
th
e
syst
e
m
’s
m
od
el
s.
F
or
this
r
easo
n,
the
co
de
gen
e
r
at
or
s
houl
d
be
able
to
inte
rpre
t
the
ne
w
sem
a
ntic
of
LOC
a
nd
ge
ne
rate
the
corres
pondin
g
cod
e
includi
ng
syst
e
m
m
e
tho
ds
,
m
et
ho
ds
bodie
s,
cl
ass
at
tribut
es,
secur
it
y
in
fr
ast
r
uctu
re,
se
cur
it
y
co
ntro
ll
er,
an
d
DAO.
A
s
a
res
ult,
the
non
-
f
unct
ion
al
as
pects
config
ur
at
io
ns
will
be
decr
e
ased
aut
om
atic
al
ly
accord
in
g
to
the
chosen
platfo
r
m
by
prov
i
ding
the
functi
oning
r
ules
de
fini
ti
on
co
nce
rn
i
ng
the
us
er
pe
r
m
i
ssion
s
an
d
da
ta
flow
protect
ion
.
By
app
ly
in
g
t
he
new
de
fini
ti
on
of
L
OC,
desig
ners
a
nd
de
velo
per
s
c
an
ben
e
fit
f
rom
nu
m
ero
us
adv
a
ntage
s
whic
h
are:
1.
Re
du
ci
ng d
esi
gn er
rors.
2.
Re
du
ci
ng the s
yst
e
m
secur
it
y.
3.
Im
pr
ov
i
ng the
syst
e
m
’s
qu
al
it
ie
s.
4.
Keep
i
ng a
rev
e
rse
-
e
ngineeri
ng
durin
g
syst
e
m
d
esi
gn
.
5.
Im
pr
ov
e
the
de
sign
e
r’
s
kn
ow
l
edg
e
in
te
rm
s o
f
sec
ur
it
y t
ech
niques.
6.
Ver
ify
in
g
t
he
s
ecur
it
y p
olici
es co
ns
trai
nts
r
el
at
ed
to
syst
em
resou
rces
before
u
si
ng them
.
7.
Im
pr
ov
i
ng the
m
od
el
ing
quali
ty
.
3.4
.
Securi
t
y Cons
tra
in
ts
S
ynt
ax
In
t
his
sect
io
n,
we
pro
vid
e
m
on
it
ori
ng
m
echan
ism
s
to
en
han
ce
the
sta
ti
c
an
d
dynam
ic
be
hav
i
or
of
syst
e
m
s
with
t
he
sec
uri
ty
co
ns
trai
nts
of
a
ut
hen
ti
cat
io
n
veri
ficat
ion
,
aut
horizat
io
n
ver
i
ficat
ion
,
data
int
egr
it
y
ver
ific
at
io
n,
a
n
d
enc
ryptio
n
ve
rificat
ion.
crit
ic
al
data
by
app
ly
in
g
th
e
UML
pro
file
.
im
pr
ov
e
d
with
th
e
necessa
ry
sec
ur
it
y
co
ns
trai
nts,
w
hich
a
r
e
desc
ribe
d
by
OCL.
The
n,
these
co
ns
tr
ai
nts
an
d
a
ny
oth
e
r
enh
a
ncem
ents w
il
l be appli
ed
o
n
t
he
S
DS
I
B
to assig
n
sec
uri
ty
r
equ
irem
e
nts an
d res
pons
i
bili
ti
es to th
e obj
ect
s
involve
d
in
the
execu
ti
on
of
a
syst
e
m
action
.
To
ta
ke
int
o
a
ccount
the
c
ode
gen
e
rati
on
of
the
inf
rastr
uctur
e
of
the
syst
e
m
.
se
cur
it
y,
with
th
e
secur
it
y
templa
te
s
app
li
ed
to
the
functi
on
al
aspects
wh
e
n
ge
ner
at
in
g
the
co
de
accor
ding t
o
th
e ch
os
e
n plat
form
; t
he
gen
e
rated c
od
e
w
il
l
be
a lan
gu
a
ge u
ndersta
nd
a
ble
by
the co
m
pilers
.
Evaluation Warning : The document was created with Spire.PDF for Python.
In
t J
Elec
&
C
om
p
En
g
IS
S
N:
20
88
-
8708
A U
M
L Pr
ofil
e for
Sec
ur
it
y and C
ode
Ge
ner
ation
(
A
bdel
lat
if
La
s
bahani
)
5283
By
app
ly
in
g
a
set
of
m
od
el
tran
sf
or
m
at
ion
,
t
he
pro
pose
d
ge
ner
at
or
ge
ner
at
es
a
bu
il
t
-
in
s
ecu
rity
con
t
ro
ll
er
(S
C
)
to
chec
k
the
se
m
antic
s
of
the
secu
rity
po
li
ci
es
represe
nted
by
the
ste
reo
ty
pes
duri
ng
t
he
so
ft
war
e
de
velop
m
ent
proces
s;
the
secu
rity
po
li
cy
inf
rastr
uctu
re
ge
ne
rated
f
ro
m
the
S
DS
IB
i
n
the
f
or
m
of
XMI
/
XML
.
3.5.
Securi
t
y
P
olici
es Const
r
ain
t
s
S
ynt
ax for
P
ermi
ssion M
oni
to
ri
n
g
To
interact
with
software
c
om
po
nen
ts,
a
uthorizat
io
n
m
on
it
or
in
g
is
reco
m
m
end
ed
to
c
he
ck
the
sta
tus
of
the
l
ogge
d
-
on
use
r'
s
ide
ntit
y
based
on
the
sec
ur
it
y
po
li
ci
es
in
volved
in
m
od
e
li
ng
the
requ
est
ed
com
po
ne
nts.
I
n
our
m
et
ho
dolo
gy,
a
uth
e
ntica
ti
on
an
d
a
ut
horizat
i
on
sec
ur
it
y
poli
ci
es
are
stre
ngthe
ne
d
t
o
ens
ur
e t
he dura
bili
ty
o
f un
s
up
erv
ise
d req
uest
s thro
ugh sec
ur
it
y po
li
cy
cons
trai
nts.
To
do
this
,
we
pro
posed
the
synta
x
of
the
secur
it
y
c
on
st
r
ai
nt
to
rein
for
ce
us
e
r
a
uth
e
nt
ic
at
ion
an
d
auth
or
iz
at
io
n v
ia
the O
CL
to
re
s
tric
t un
a
ut
horized acce
ss as
sh
ow
n belo
w
.
Con
te
xt Ob
j
ect
_N
am
e
Inv: li
st_users
-
>i
nclud
e
s(c
onnected
_user
)
In
a
ddit
ion
,
each
cl
ass
st
ereo
ty
pe
d
with
a
sec
ur
e
s
te
reo
ty
pe,
aut
om
atical
ly
a
pr
el
im
inary
authe
ntica
ti
on
is t
rigg
e
re
d bef
or
e
interact
in
g wit
h
the
r
e
ques
te
d
res
ources
.
In
this
a
ppr
oac
h,
we
ap
plied
secur
it
y
c
heck
i
ng
on
the
co
nt
ent
of
syst
em
obj
ect
s
t
hem
se
lves
s
uc
h
as
m
et
ho
ds,
at
tribu
te
s
,
ass
ociat
ion
s
,
res
ource
s,
data
flo
ws
betwee
n
obj
ec
ts,
an
d
im
plem
ented
inter
fa
ces
t
o
decr
ease
syst
em
secur
it
y.
To
do
th
is,
we
ha
ve
prof
il
ed
the
syst
e
m
obj
ect
s,
ope
rati
ons
a
nd
at
trib
utes
w
it
h
th
e
al
read
y
im
pr
oved
UML
profi
le
with
the
se
cur
it
y
poli
cy
con
st
raints
propose
d
by
the
s
e
cur
it
y
ex
per
ts.
These
const
raints a
re
assigne
d
t
o
the
U
ML
pro
file
accordin
g
t
o
the
foll
ow
i
ng syn
t
ax,
a
s s
how
n b
el
ow
.
Con
te
xt Ob
j
ect
_n
am
e:
: M
et
ho
d_Nam
e(Par
a
m
et
rs)
::
Ret
ur
n_Ty
pe
pr
e:
Self.
Op
e
ra
ti
on
_Nam
e.Per
m
issi
on
s
-
>
No
t
Em
pty
and self.att
ri
bute
s
-
>N
otEm
pt
y
and Co
nnect
ed
_U
se
r.ro
le
.p
e
r
m
issi
on
s>i
nclu
des
(self.
O
per
at
io
n_Nam
e.p
erm
is
sion
s
)
and
Vie
w_OR
_U
RL
.p
e
rm
isio
ns
-
>
include
s(c
onne
ct
ed_User.r
ole.
View
_N
am
e_O
R_
URL.
perm
issi
on
s)
and self.a
sso
ci
at
ion
E
nd.p
e
rm
issi
on
s
-
>i
nclu
de
s(con
nected
_User
.p
e
rm
issi
on
s
-
>sel
ect
(
pe
r
m
issi
on
sass
ociat
ion
.
per
m
issi
on
s)
)
In
our
UML
prof
il
e,
we
ha
ve
dev
el
op
e
d
a
s
pe
ci
fic
m
et
a
-
cl
a
ss
(stere
otype)
to
ap
ply
secur
i
ty
po
li
ci
es
on
the
at
tribu
te
s
of
syst
em
obje
ct
s.
F
or
t
his,
we
hav
e
im
pr
oved
this
ste
reo
t
ype
with
the
se
cur
it
y
co
ns
trai
nts
of
the
poli
cy
as
sh
ow
n
in
the
fol
lowing
synta
x.
As
a
r
esult,
t
his
so
l
ution
he
lps
re
du
ce
se
c
ur
it
y
vulnera
bi
li
ti
e
s
and im
pr
ov
es
the
qu
al
it
y o
f
th
e g
e
ner
at
e
d
sys
tem
s.
Con
te
xt Ob
j
ect
_N
am
e
Pr
e:
self
.att
rib
utes>f
orAll
(att
rib
ute | at
trib
ute
-
>N
otEm
pty)And
Connect
ed
_Us
er.role.
per
m
issi
on
s>i
nclu
des(sel
f.
at
trib
utes.
per
m
issi
on
)
And pr
im
it
ives
Ty
pes
-
>e
xists(
sel
f
.att
rib
utes.t
ype)
And
C
oonecte
d_Use
r
-
>
size
()
=
self.att
ri
nute
s.
m
ulti
plicit
y
In
this
m
et
ho
dolo
gical
suppo
rt,
we
hav
e
pr
opos
e
d
an
ot
he
r
m
et
a
-
cl
ass
to
reinfo
rce
data
encr
y
ption
durin
g
interac
ti
on
s
bet
ween
so
ftwa
re
co
m
po
nen
ts.
T
hi
s
m
et
a
-
cl
ass
enr
ic
hes
with
the
secur
it
y
po
li
c
y
const
raints
on
data
encr
y
ptio
n
as
sh
ow
n
in
the
fo
ll
ow
i
ng
synta
xes;
the
first
app
li
e
d
to
the
at
tribu
te
s
of
the
obj
ect
an
d
the
second
to
th
e
entit
ie
s.
As
a
resu
lt
,
the
cod
e
gen
e
rato
r
enr
ic
hed
with
a
sp
eci
fic
templa
te
ded
ic
at
e
d
to
th
e ad
o
ptio
n o
f p
rofil
ed
m
od
el
s
with e
xis
ti
ng dat
a encr
y
ption
al
gorithm
s
.
Con
te
xt Ob
j
ect
_N
am
e
Inv: self
.att
rib
utes.
value
-
>
N
otEm
pty
po
st
: sel
f.
at
tri
bu
te
.
value
=co
nv
e
rt(self
.att
ribu
t
r@pre
)
Con
te
xt ob
j
ect
_N
am
e
Inv: self
.v
al
ue
-
>No
tEm
pty
Po
st:
sel
f
.v
al
ue
@pre=sel
f.val
ue@p
os
t
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2088
-
87
08
In
t J
Elec
&
C
om
p
En
g,
V
ol.
8
, N
o.
6
,
Dece
m
ber
201
8
:
5278
-
5291
5284
In
order
to
va
li
date
these
con
st
raints,
we
app
li
ed
the
s
ecur
it
y
prof
il
e
after
it
s
extensio
n
to
the
secur
it
y
c
on
st
r
ai
nts
on
t
he
S
DS
EB
a
s
s
how
n
in
Fi
gure 1
.
W
e
im
ple
m
ent
ed
the
p
r
opos
e
d
gen
e
rato
r
t
o
gen
e
rate
the
source
co
de
co
rr
e
spo
nd
i
ng
to
the
two
f
unct
ion
al
an
d
non
-
f
unct
ion
al
a
sp
ect
s
by
their
tem
plate
s
des
cribe
d
thr
ough the
h
el
ps
.
Figure
1
.
S
DSEB
profil
ed wit
h
E
ncr
ypte
d
st
ereo
ty
pe
3.6.
D
ata
In
tegri
ty
C
on
s
tra
in
ts
Sem
antic
ally,
we
ha
ve
stren
gt
hen
e
d
our
m
eth
od
ology
to
ap
pro
ve
the
sta
te
of
the
ob
j
ect
in
te
rm
s
of
data
integ
rity
wh
e
n
dev
el
op
i
ng
pr
e
re
qu
isi
te
s
and
post
-
c
onditi
on
s
.
W
e
ha
ve
de
velo
pe
d
s
pecific
ste
re
otypes
to
prom
ote
so
ft
w
are
c
om
po
ne
nts
with
data
int
egr
it
y
issue
s.
These
ste
re
otypes
a
pply
to
t
he
interm
ediat
e
m
od
e
l
and
it
s
c
on
te
nt,
w
hich
is
de
ri
ved
from
PSM
to
increase
software
re
qu
ire
m
ents
with
dat
a
integrity
co
nc
ern
s
.
To
facil
it
at
e
t
he
c
on
st
ru
ct
io
n
of
data
inte
gr
it
y
co
ns
trai
nt
s,
we
have
s
uggeste
d
a
sy
ntax
for
c
hecki
ng
t
he
integrity
of
ob
je
ct
data,
as
s
ho
wn
i
n
the
f
ollo
wing
synta
x.
T
he
c
od
e
ge
ner
a
tor
e
nr
ic
hed
wi
th
a
s
pecific
m
od
el
ded
ic
at
e
d
to
d
a
ta
integr
it
y f
or
the con
ver
si
on
of p
rofil
ed
m
od
el
s int
o
s
ourc
e co
de
.
Con
te
xt Ob
j
ect
_N
am
e
Pr
e:
self
-
>N
ot
Em
pty
Po
st:
self
.att
rib
utes.
values
-
>
forA
ll
(
v
al
ue
|
at
tribu
te
.
value =
at
tribu
te
.
valu
e@pre)
Ther
e
f
or
e,
we
can
af
fect
sec
uri
ty
po
li
cy
m
o
nitor
i
ng
by
a
pply
ing
t
he
new
LOC
def
i
niti
on
a
nd
m
or
e
sp
eci
fical
ly
durin
g
SD
S
IB
de
velo
pm
ent.
We
ob
ta
ine
d
SDSIB
from
the
SD
SEB
by
appl
yi
ng
the
new
LOC
to
determ
ine all
t
he
c
om
po
ne
nts
involve
d
i
n
pe
rfor
m
ing
s
of
tw
are acti
ons a
nd to
s
upport the
secur
it
y arc
hitec
ture
at
the sam
e time b
y a
pp
ly
in
g
t
he UML
prof
il
e.
We
hav
e
ex
pa
nd
e
d
t
he
GRAS
P
m
od
el
s
t
o
assi
gn
res
pons
i
bili
ti
es
and
sec
ur
it
y
pol
ic
ie
s
to
the
so
ft
war
e
com
po
ne
nts.
T
he
ne
w
se
m
antic
s
of
GR
AS
P
al
low
us
to
pr
ec
ise
ly
def
ine
the
syst
e
m
resour
ce
s
need
e
d
to
com
plete
the
bu
si
ne
ss
processes
of
the
syst
em
by
recogn
iz
i
ng
the
con
strai
nts
of
lo
w
coupli
ng
a
nd
strong co
hesi
on
.
Evaluation Warning : The document was created with Spire.PDF for Python.
In
t J
Elec
&
C
om
p
En
g
IS
S
N:
20
88
-
8708
A U
M
L Pr
ofil
e for
Sec
ur
it
y and C
ode
Ge
ner
ation
(
A
bdel
lat
if
La
s
bahani
)
5285
3.7.
Gras
p P
attern
s Concep
t
Crai
g
Larm
an
has
create
d
Grasp
patte
r
ns
to
so
lve
m
od
el
ing
erro
rs.
T
he
pur
pose
of
gr
a
s
p
patte
r
ns
is
to
pro
vid
e
a
m
echan
ism
fo
r
a
ssign
i
ng
r
esp
onsibil
it
ie
s
to
so
li
ci
te
d
syst
e
m
obj
ect
s
to
exec
ute
syst
e
m
pr
oc
esses.
In
fact,
t
her
e
a
re
nin
e
i
nput
m
od
el
s
that
ar
e:
low
c
oupli
ng,
high
c
ohesi
on,
d
esi
gner
,
e
xp
e
rt,
c
ontroll
er,
pure
m
anu
fact
ur
i
ng,
po
ly
m
or
ph
is
m
,
info
rm
at
ion
ex
per
t
an
d
protect
ed
va
riat
ion
s.
I
n
our
m
et
ho
dolo
gy,
we
ha
ve
exten
ded
the
m
to
ta
ke
account
of
the
sam
antic
sand
const
raints
of
secur
it
y
poli
ci
es
wh
e
n
as
signi
ng
respo
ns
ibil
it
ie
s
by
i
m
pr
ov
i
ng
the
low
c
oupling
a
nd
high
co
hesio
n.
I
n
a
dd
i
ti
on
,
we
ha
ve
add
e
d
an
ot
her
pa
tt
er
n
to
the
existi
ng
patte
rn
s
,
w
hich
is
the
secur
it
y
con
t
ro
ll
er
depl
oyed
to
m
on
it
or
in
frast
r
ucture
secur
it
y
acco
rdi
ng
to
the
cho
se
n
platfo
rm
and
pu
t
in
place
consi
der
at
io
ns
o
f
low
c
ouplin
g
and
high
co
hesion
;
this
co
ntr
ol
le
r
is
po
sit
io
ne
d
at
the
f
ront
to
int
ercept
the
sta
t
us
of
que
ries
com
ing
from
ou
tsi
de.
In
Ta
bl
e
1,
we
s
how
t
he
ne
w
sem
antic
s o
f
s
om
e
m
od
el
s.
Table
1.
Gr
a
sp patt
er
ns
a
nd th
ei
r
ne
w
sem
antic
Grasp p
attern
D
escri
p
tio
n
New se
m
an
tic
Low co
u
p
lin
g
Mini
m
ize
th
e
lin
k
s
b
etween
syste
m
's
co
m
p
o
n
en
ts
to
f
acilitate
th
eir
s
calabil
ity
,
readab
ili
ty
,
re
liab
ilit
y
,
an
d
r
eu
sab
ility
.
Rein
f
o
rce
th
e
syste
m
’
s
co
m
p
o
n
en
ts
to
v
erify
th
e
secu
r
ity
p
o
licies
p
ro
p
o
sed
th
rou
g
h
th
e
UML
p
rof
ile
b
ef
o
re
estab
lish
in
g
a
n
ew
lin
k
b
etween
syst
e
m
’
s
o
b
jects.
Hig
h
coh
esio
n
Rein
f
o
rce
th
e
sy
ste
m
’
s
o
b
jects
to
reali
ze
th
e
actio
n
s b
elo
n
g
to it
s resp
o
n
sib
ilities.
I
m
p
rov
e
th
e
syste
m
’
s
o
b
jects
resp
o
n
sib
ilities
with
th
e
secu
rity
p
o
licies
co
n
d
itio
n
s
illu
strat
ed
b
y
th
e
UM
L
p
r
o
f
ile;
th
ese
co
n
strain
ts
ch
ecked
o
u
t
t
h
rou
g
h
th
e
d
esig
n
pattern
:
secu
rity
co
n
troller
.
Secu
rity
Co
n
trolle
r
Ded
icated
to
sep
ar
ate
b
etween
th
e
sy
ste
m
’
s
la
y
e
rs
an
d
f
aci
litate the s
y
ste
m
’
s
scalabi
lit
y
.
W
e
h
av
e
p
rop
o
sed
a
n
ew
d
esig
n
p
attern
sacrif
iced
f
o
r
m
o
n
ito
ring
th
e
n
o
n
-
f
u
n
ctio
n
al
p
rop
erties
to
i
m
p
rov
e
th
e
lo
w
co
u
p
lin
g
an
d
hig
h
co
h
esio
n
By
app
ly
ing
th
e
new
sem
antic
of
gras
p
patte
rn
s
,
we
can
i
ntr
oduce
an
d
ve
rify
the
secu
r
it
y
po
li
ci
es
const
raints duri
ng
t
he
assi
gnm
ent
of
res
ponsi
bili
ti
es
to
the
obj
ect
s
in
vo
l
ve
d
in
achie
ving
the
syst
em
’s
act
ion
s.
Desig
ners
enr
i
ch
syst
em
’s
fu
nctionalit
ie
s
w
it
h
the
secur
it
y
po
li
ci
es
exige
ncies
by
ap
plyi
ng
the
ne
w
de
f
init
ion
of gras
p
a
nd th
e secu
rity
p
r
of
i
le
.
3.8.
Ov
er
view
of
Exte
nded Po
stc
on
diti
on
In
this
w
ork
,
we
exten
de
d
the
LOC
postc
onditi
on
t
o
co
ns
ide
r
the
vali
dation
of
sec
uri
ty
po
li
ci
es
descr
i
bed
in
the
pr
e
re
qu
isi
te
.
Syst
em
atical
l
y,
the
postc
on
diti
on
de
fines
the
basic
sta
te
of
the
syst
em
afte
r
execu
ti
on
of
th
e
syst
e
m
us
e
c
ases.
This
e
xtension
al
lows
dom
ai
n
exp
erts
to
i
m
pr
ove
the
functi
on
al
it
y
of
the
syst
e
m
with
the
se
m
antic
s
of
secur
it
y
poli
ci
es
and
m
or
e
spe
ci
fical
ly
the
c
reati
on
o
f
obj
e
ct
s,
the
destr
uc
ti
on
of
obj
ect
s,
the
form
atting
of
as
so
ci
at
ion
s
,
the
destru
ct
i
on
of
associat
io
ns
and
th
e
cha
nge
of
sta
te
after
the
execu
ti
on
of
t
he
request.
Th
eref
or
e
,
do
m
ain
’s
ex
pe
rts
use
our
UML
pro
file
to
im
pr
ove
the
S
DS
IB
with
th
e
secur
it
y
po
li
ci
es
con
st
raints
about
authe
nt
ific
at
ion
,
aut
horizat
ion,
dat
a
integrity
,
avail
abili
ty
,
and
data
encr
y
ption
.
4.
P
ROP
OSE
D APP
ROAC
H
In
t
his
co
ntri
bu
ti
on,
we
present
a
ne
w
appr
oach
f
or
m
od
el
ing
the
so
ft
war
e
a
rc
hitec
ture
a
nd
integrati
ng
t
he
m
os
t
i
m
po
rtant
secu
rity
co
ns
ide
rati
ons
in
to
syst
em
desi
gn.
Our
inte
ntion
is
t
o
ov
e
r
wh
el
m
secur
it
y
vulner
abili
ti
es
and
increase
t
he
sc
al
abili
ty
of
secur
it
y.
W
e
us
e
d
our
m
et
ho
do
log
y
f
or
the
U
P
-
X
P
appr
oach
t
o
ov
erco
m
e
non
-
functi
on
al
featu
r
es
thr
oughout
th
e
softwa
re
de
velo
pm
ent
pr
oc
ess.
W
e
e
nc
oura
ge
d
this
ap
proac
h
with
a
par
ti
cul
ar
co
de
ge
ner
a
tor
to
pro
duce
the
fi
nal
co
de
from
pr
ofi
le
d
m
od
el
s.
As
a
resu
lt
,
so
ft
war
e
de
vel
op
e
rs
acc
urat
el
y
pro
du
ce
the
internal
be
hav
i
or
of
th
e
syst
e
m
and
act
on
t
he
lo
w
co
upli
ng
a
nd
high c
oh
e
sio
n
t
o pro
vid
e
reada
ble syst
em
s a
s sho
wn in Fi
gure
2.
To
do
this
,
we
us
e
d
MD
A
a
s
a
m
od
el
ing
la
ngua
ge
t
hat
s
upports
the
e
xten
ded
use
of
m
od
el
s
th
rou
gh
m
od
el
transfo
rm
ation
.
Thes
e
cha
nges
al
l
ow
arc
hitec
ts
an
d
de
velo
pe
rs
to
m
anage
the
var
i
ous
c
ha
nges
pro
du
ce
d
in
th
e
custom
er'
s
need
s
an
d
to
a
ut
om
at
e
the
m
ain
te
na
nce
an
d
e
vo
l
ution
of
e
xi
sti
ng
syst
em
s
via
the
m
app
in
g ru
le
s
betwee
n
the
tw
o functi
onal
and
non
-
f
un
ct
io
na
l aspect
s.
First,
we
ge
ne
rated
the
SDS
IB
from
SD
S
EB
after
a
pp
l
yi
ng
the
ne
w
LOC
in
or
de
r
to
co
rr
ect
ly
determ
ine
al
l
t
he
interact
io
ns
and
syst
em
com
po
nen
ts
in
vo
lved
in
t
he
exe
cution
of
the
s
yst
e
m
pr
ocess
es.
I
n
this m
od
el
, w
e
assign t
he res
pons
i
bili
ti
es and secu
rity
sem
a
ntics t
o
syst
em
’s objects.
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2088
-
87
08
In
t J
Elec
&
C
om
p
En
g,
V
ol.
8
, N
o.
6
,
Dece
m
ber
201
8
:
5278
-
5291
52
86
This
m
od
el
is
con
si
der
e
d
a
Plat
fo
rm
-
ind
e
pende
nt
Mod
e
l
(P
IM)
gen
e
r
at
ed
from
the
Com
pu
ti
ng
Inde
pende
nt
Mod
el
(CIM)
m
od
el
by
ap
pl
yi
ng
a
set
of
m
od
el
-
to
-
m
odel
trans
form
at
i
on
s;
CIM
fo
c
use
s
on
t
he
syst
e
m
env
iro
nm
ent.
Then
we
pro
du
c
e
the
PSM
by
addi
ng
the
m
os
t
i
m
po
rtant
infor
m
at
ion
relat
ed
to
the
chosen
pla
tfo
r
m
(p
la
tfo
rm
mo
dels
)
to
P
IM.
The
P
SM
al
rea
dy
i
m
pr
ove
d
with
the
sec
ur
i
ty
po
li
ci
es
sem
antic
s
.
Ther
e
f
or
e,
we
m
us
t
i
m
pr
ov
e
i
t
with
the
co
nst
raints
of
sec
ur
it
y
po
li
ci
es
dep
en
ding
on
the
cho
se
n
platf
or
m
.
To
do
this
,
we
ha
ve
al
lowe
d
PS
M
extensibili
ty
by
deduct
in
g
an
interm
ediat
e
m
od
el
from
PSM;
the
inter
m
ediat
e
m
od
el
is read
y
to r
ecei
ve othe
r
im
pr
ov
em
ents r
el
at
ed
t
o
a
non
-
f
unct
ion
al
a
sp
ect
.
In
a
dd
it
io
n,
we
hav
e
ste
reo
ty
ped
t
his
m
od
el
with
our
UM
L
prof
il
e
(s
ecu
rity
pr
ofi
le
)
to
grow
it
with
the
con
st
raints
of
sec
uri
ty
po
li
ci
es.
The
U
ML
pr
ofi
le
for
secur
it
y
is
an
extensi
on
of
UML
ded
ic
at
ed
to
i
m
pr
ovin
g
the
so
ft
war
e
’s
f
un
ct
ion
al
it
ie
s
with
sec
ur
it
y
feat
ur
es
relat
ed
t
o
authe
ntica
ti
on,
auth
ori
zat
ion
,
data
integrity
,
a
nd
dat
a
encr
ypti
on
;
The
UML p
r
ofi
le
is
base
d
on
ste
r
eoty
pes
an
d
values
m
ark
ed
to
a
dopt U
M
L
f
or
a p
a
rtic
ular per
form
ance.
Pr
act
ic
al
ly
,
we
hav
e
pro
pose
d
a
sp
eci
fic
cod
e
ge
ner
at
or
for
the
UP
-
XP
appro
a
ch
to
ge
ner
at
e
th
e
so
urce
c
ode
c
orres
pondin
g
t
o
both
functi
on
al
and
no
n
-
fun
ct
ion
al
as
pects
.
T
his
co
de
ge
ner
at
or
ta
kes
a
s
input
an
al
rea
dy
a
nnotate
d
inte
rm
e
diate
m
od
el
with
secu
rity
poli
cy
perform
ances
an
d
c
onve
rts
it
into
s
ource
co
de
.
It
us
es
their
t
e
m
plate
s
to
gen
erate
the
fi
nal
co
de
by
weav
i
ng
t
he
s
ecur
it
y
po
li
ci
e
s
on
the
s
oft
war
e
’s
functi
onal
it
ie
s
thr
ough
thes
e
t
e
m
plate
s;
a
tem
pla
te
descr
ib
ed
by
helpers.I
n
Fig
ur
e
3,
a
di
agr
am
descr
ib
ing
the
ow
e
r
view
of
the
ap
proac
h.
We
al
so
il
lustr
at
e
the
m
os
t
i
m
po
rtant
sta
tio
ns
f
or
the
producti
on
of
se
cur
e
a
nd
scal
able ap
plica
ti
on
s.
In
Fi
gure
4,
w
e
pr
ese
nt
a
cu
r
ren
t
ex
am
ple
descr
i
bing
ho
w
to
aut
om
at
i
cal
ly
gen
erate
the
com
plete
cod
e
for
syst
e
m
’s
entit
es,
attribu
te
s,
opera
ti
on
s,
per
sist
e
nt
entit
ie
s,
an
d
secu
rity
config
ur
at
io
n.
T
he
so
urce
cod
e
de
du
ce
d
from
the
desig
n
m
od
el
ob
ta
i
ned
from
SD
S
IB
by
ap
plyi
ng
a
set
of
m
od
el
transfor
m
at
i
on
s
.
I
n
this
conversi
on,
we
e
nr
ic
hed
the
do
m
ai
n
class
diag
ram
w
it
h
the
necessa
ry
op
e
rati
ons
der
i
ved
f
r
om
SD
S
I
B
al
read
y
en
hanced
with
the
s
e
m
antic
s
of
se
cur
it
y
po
li
cy
con
st
raints.
T
he
n,
we
a
ppli
ed
the
secu
rity
pr
of
il
e
def
i
ned
by
U
ML
prof
il
e
to
increase
the
secur
it
y
of
sec
ur
e
sem
antic
s.
Af
te
r
ha
ving
been
ste
reo
ty
pe
d
th
e
interm
ediat
e
m
od
el
,
the
co
de
gen
e
rato
r
i
nter
ven
e
s
to
wea
ve
their
te
m
plates
into
the
syst
e
m
'
s
functi
on
a
li
ti
es.
As
y
ou
can
se
e,
we
a
nnotate
d
Em
ai
l,
L
og
i
n,
a
nd
Passwo
rd
res
pecti
vely
with
Em
ai
lVa
li
dation,
uniq
ue
a
nd
encr
y
pted
ste
r
eoty
pes.
As
a
resu
lt
,
these
ste
reo
ty
pes
e
xt
end
thes
e
at
trib
utes
with
t
he
secu
rity
poli
ci
es
const
raints.
Figure
2
.
Dia
gra
m
descr
ibi
ng
the owe
rv
ie
w of t
he
a
ppr
oac
h
Evaluation Warning : The document was created with Spire.PDF for Python.
In
t J
Elec
&
C
om
p
En
g
IS
S
N:
20
88
-
8708
A U
M
L Pr
ofil
e for
Sec
ur
it
y and C
ode
Ge
ner
ation
(
A
bdel
lat
if
La
s
bahani
)
5287
Figure
3
.
Ru
nning
e
xam
ple o
f
code
gen
e
rati
on
from
p
rofil
ed
m
od
el
5.
S
EQUE
NC
E
DIAGR
A
M
O
F SYSTE
M
’S
INTER
NA
L
B
EHAVOIR
Sequence
Dia
gr
am
of
Syst
em
’s
In
te
rnal
B
ehav
i
or
(SD
SI
B)
is
a
se
quence
diagr
am
got
f
r
om
the
Sequence
Dia
gram
of
Syst
em
’s
E
xter
nal
Be
hav
i
or
(SDS
E
B)
after
it
s
enl
arg
em
ent
with
the
new
sem
a
ntic
of
LOC
an
d
gr
as
p
patte
r
ns
.
O
ur
ov
e
rall
strat
egic
obj
ect
ive
is
to
ind
ic
at
e
respon
si
bili
ti
e
s
to
syst
e
m
e
ntit
ie
s
thr
ough
the
ne
w
e
xtension
of
desi
gn
patte
rn
high
c
ohe
sion
,
sec
ur
it
y
con
t
ro
ll
er,
ex
pe
rt,
creat
or,
a
nd
low
couplin
g
.
We
hav
e
update
d
t
hese
re
spo
ns
ib
il
ities
to
ta
ke
into
acc
ount
th
e
secur
it
y
co
nt
ext
sug
gested
by
the
chosen
platf
orm
descr
ibe
d
via
the
UML
prof
il
e
f
or
secu
rity
.
This
te
ch
niq
ue
will
prom
ote
the
inte
gr
a
ti
on
of
secur
it
y
poli
cy
con
st
raints
at
the
in
te
rm
ediate
m
od
el
le
vel.
In
a
ddit
ion
,
we
hav
e
rein
force
d
this
c
omm
itm
ent
to
des
cribe
th
e
sta
te
of
the
syst
e
m
bef
ore
an
d
afte
r
e
xe
cuting
syst
em
act
ion
s
i
n
a
se
cur
e
m
ann
e
r.
I
n
this
SD
S
IB,
we
ci
te
pr
eci
sel
y
al
l
the
com
po
ne
nts
of
the
syst
e
m
,
and
the
interact
io
n
s
ne
go
ti
at
ed
to
pe
r
form
a
requested
acti
on; S
DS
I
B
foc
use
d o
n
the
tem
poral as
pect of
the m
essage tr
ansacti
on
betw
een syste
m
o
bject
s.
To
prov
i
de
a
n
appr
oach
that
consi
de
rs
no
n
-
functi
onal
a
sp
ect
s
du
rin
g
the
softwa
re
de
velo
pm
en
t
process
to
pr
oduce
scal
a
ble
and
sec
ur
e
s
of
t
war
e
,
we
pro
vi
de
pote
ntial
enh
ancem
ents
to
the
SD
SEB
to
inj
ect
the
se
m
antic
s
and
str
uctur
e
of
the
non
-
f
un
ct
io
nal
aspe
ct
s
du
ri
ng
the
ir
el
abo
rati
on
.
The
new
S
DSI
B
Evaluation Warning : The document was created with Spire.PDF for Python.