Toward Automatic Enforcement of Security Patterns in Software Architecture Using Alloy
摘要
As software architectures become increasingly complex, securing them against cybersecurity attacks has become a critical and challenging aspect of application design. This paper introduces a formal framework for the automatic enforcement of security patterns in software architecture, specifically targeting improper authorization vulnerabilities. Improper authorization occurs when access to sensitive resources violates the current access control policy. Using the Alloy framework, our approach identifies key architectural points from detected vulnerabilities. These architectural points are then used to guide the effective enforcement of appropriate security patterns that mitigate the identified vulnerabilities. We demonstrate the proposed approach through a case study in a vulnerable web application, where an authorization pattern is enforced to prevent unauthorized access. By automating this enforcement process, our method contributes to formalize the security design by reducing the reliance on manual security analysis.