Systems and methods for providing higher assurance software construction via aspects
AssigneeThe Johns Hopkins University
InventorsThomas H. Llanso, George R. Barrett, Donna C. Paulhamus, Nathan S. Reller
Life of this patent
Estimating the term…
Abstract
There are provided systems and methods for integrating requirements driven security code into an application system. The security code is integrated into an application system in such a way as to make the integrated security code maintainable and traceable as the application system evolves over time.
Claims22
A computer-implemented method for integrating requirements driven security code into an application system, the method comprising:
- identifying one or more security requirements;
- assigning unique marker annotations to each of said one or more identified security requirements;
- performing a first mapping of said one or more identified security requirements to aspects that implement the identified one or more security requirements;
- marking each of said aspects with a unique marker annotation that uniquely matches a corresponding security requirement that the aspect implements in accordance with said first mapping;
- performing a second mapping of each of said aspects to an application code base comprising marking code in the application code base using the unique marker annotations at insertion points in the application code base where each of said aspects are to be woven;
- inserting said unique marker annotations into said application code base based on said second mapping;
- and
- weaving said aspects into said application code base at said insertion points identified by said unique marker annotations to provide a precise and traceable mapping between said one or more security requirements and said application code base.
A computer program embodied on a non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to quickly label various language-level constructs of an application code base with marker annotations in an automation-assisted manner, the processor executing various code segments of the program including:
- a code segment for entering a set of actionable and non-actionable security requirements;
- a code segment for authoring an aspect for each actionable security requirement;
- a code segment for recording in each actionable requirement, an identity of the aspect;
- a code segment for locating places in the application code base where the aspects should map to, said code segment comprising means for marking each of said aspects with a unique marker annotation that uniquely matches a corresponding security requirement that the aspect implements in accordance with a first mapping;
- performing a second mapping of each of said aspects to an application code base comprising marking code in the application code base using the unique marker annotations at insertion points in the application code base where each of said aspects are to be woven;
- inserting said unique marker annotations into said application code base based on said second mapping;
- and
- weaving said aspects into said application code base at said insertion points identified by said unique marker annotations to provide a precise and traceable mapping between said one or more security requirements and said application code base.
A computer program embodied on a non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to quickly label various language-level constructs of an application code base with marker annotations in an automation-assisted manner, the processor executing various code segments of the program including:
- a code segment for entering a set of actionable and non-actionable security requirements;
- means for retrieving code segments corresponding to authored aspects for each actionable security requirement;
- a code segment for recording in each actionable security requirement, an identity of the authored aspect;
- a code segment for locating places in the application code base where the aspects should map to comprising marking each of said aspects with a unique marker annotation that uniquely matches a corresponding security requirement that the aspect implements in accordance with a first mapping;
- performing a second mapping of each of said aspects to an application code base comprising marking code in the application code base using the unique marker annotations at insertion points in the application code base where each of said aspects are to be woven;
- inserting said unique marker annotations into said application code base based on said second mapping;
- and
- weaving said aspects into said application code base at said insertion points identified by said unique marker annotations to provide a precise and traceable mapping between said one or more security requirements and said application code base.
A system for integrating requirements driven security code into an application system, the system comprising:
- a processor;
- a memory connected to the processor and storing instructions for operating the processor to perform the steps of:
- identifying one or more security requirements;
- assigning unique marker annotations to each of said one or more identified security requirements;
- performing a first mapping of said one or more identified security requirements to aspects that implement the identified one or more security requirements;
- marking each of said aspects with a unique marker annotation that uniquely matches a corresponding security requirement that the aspect implements in accordance with said first mapping;
- performing a second mapping of each of said aspects to an application code base comprising marking code in the application code base using the unique marker annotations at insertion points in the application code base where each of said aspects are to be woven;
- inserting said unique marker annotations into said application code base based on said second mapping;
- and
- weaving said aspects into said application code base at said insertion points identified by said unique marker annotations to provide a precise and traceable mapping between said one or more security requirements and said application code base.
A generic graphical user interface embodied on a non-transitory computer-readable medium that includes a program that, when executed by a processor, causes the processor to quickly label various language-level constructs of an application code base with marker annotations in an automation-assisted manner, the graphical user interface comprising:
- a menu bar providing access to graphical user interface functionality, the menu bar including a file menu for creating a new project or opening an existing project,
- an analysis menu including reporting means for displaying a report of a project in a report style,
- a title display area identifying a file including the application code base being labeled;
- a first data pane for allowing a user to enter or import security requirements;
- a second data pane for allowing the user to relate the requirements entered in the first data entry pane in a hierarchical fashion;
- a third data pane for identifying aspects to be developed by a security software developer to be made available to implement the security requirements identified in the first data pane;
- marking each of said aspects with a unique marker annotation that uniquely matches a corresponding security requirement that the aspect implements in accordance with said first mapping;
- performing a second mapping of each of said aspects to an application code base comprising marking code in the application code base using the unique marker annotations at insertion points in the application code base where each of said aspects are to be woven;
- inserting said unique marker annotations into said application code base based on said second mapping;
- and
- weaving said aspects into said application code base at said insertion points identified by said unique marker annotations to provide a precise and traceable mapping between said one or more security requirements and said application code base.
Dependencies are inferred from the claim text.