Digital Security Certificate for Services
6.2 Conceptual Model
6.2.1 Service Description
In (CC-ST), the assets are described in natural language and no iden-tifiers are provided for them; therefore, an explicit link cannot be made between the security properties and the assets that they secure. In order
6.2. CONCEPTUAL MODEL
to overcome this we adopt a asset-centric approach with explicit references between the assets and the different elements in the certificate.
Definition 2. An Asset, a, is an entity that is of some value to the consumer or the provider. Assets can be data, applications, the IT equipment on which the service operates or even users of the Information System.
The CC-ST contains the Target of Evaluation (TOE) that describes the system that is being certified and the the boundaries of the evaluation are indicated, albeit in an ad-hoc manner. However for a machine readable certificate there should be a clear distinction between the system that is being certified and the aspects of the system that are subject to evaluation.
It is of utmost importance in service based systems, due to the fact that services can be easily composed of external services and this information should be a part of the service description but clearly marked as outside the scope of evaluation.
The TOE in a CC-ST also contains the system architecture, the differ-ent compondiffer-ents that compose the system among other information such as configuration in which the system is evaluated, the underlying IT archi-tecture etc., and this is represented in natural language accompanied by architecture diagrams. This poses another issue in representing the TOE in a machine processable manner. So in order to address these two issues, we introduced an element called Target of Certification (T OC) that describes the service being certified, in addition the TOE which describes the part of the Target of Certification that is evaluated.
Definition 3. A Target of Certification is a tupleT OC =hACI,DM,T T,T Hi, whereACIis Asset-Component Identification,DMis the Deployment Model, T T is the TOC Type andT H is the TOC Cryptographic Hash.
Definition 4. An Asset-Component Identification is a tupleACI =hA,C, αi, where A is a set of all the assets identified for the TOC, C is a set of all the components in the TOC and α ⊆ A ×2C maps each Asset with a set of Components.
Definition 5. A Deployment Model (DM) is a set of software configurations (sc ∈ DM) and the software configuration is a tuple sc = hSs,SCci, Ss identifies the software component in the deployment environment and SCc is a set of all allowed configurations for the software component.
Definition 6. A software component configuration scc ∈ SCc is a key-value pairscc ={k, v}that identifies the configuration key and configuration value respectively.
85
Definition 7. The T OE is a subset of the Asset-Component Identification.
T OE ⊆ ACI
The TOCComponentsare an integral part of theT OC as they allow the T OCto be expressed in a modular and structured manner. It comprises an abstract model of the Component, theComponent Model: it can be as simple as just containing the interfaces of the component, or a more detailed spec-ification of the internal dynamics of the component as deemed sufficient by theCertification Authorities. It must also contain technical specifications of the Component, again at the level of abstraction as deemed sufficient.
Definition 8. A Component is a tupleC =hCid,CMi, whereCMis the com-ponent model andCid is the component identifier.
In the current security certification schemes the target of evaluation, which is basically the system being certified, is described in natural lan-guage and in an ad-hoc manner. There is no explicit description of the system internals nor its internal dynamics in a concrete manner. At most the system description is given at a very abstract and high level point of view. This creates a situation where the system being certified along with the security mechanisms that are implemented in the system are described in a manner that is completely detached from the actual system.
In order to overcome this, a novel means to represent the system that is being certified that ties to the actual implementation of the system is needed. The thesis contributes in this area, by proposing a flexible and extendible model to describe the service components.
The aim of this model is to capture the system design, interactions and information flow between the components.
Definition 9. The component model is a tuple CM = hAT,OP,IN T i, where AT is the set of Attributes, OP is the set of Operations, and IN T is the Interaction Model.
This facilitates encapsulating different facets of a component in one model, thereby having an integrated structure to capture the structure, and the interactions.
Definition 10. An Attribute is a tuple AT = hAn, At, Adi, where An is the Attribute,Atis the Attribute type, while theAdis the Attribute data type.
Definition 11. An operation is a tupleOP =hOPn,ATd, OPdi, whereOPnis the Operation,AT ⊆ ATd is the Input attributes for the Operation, while the OPdis the Operation return data type.
6.2. CONCEPTUAL MODEL
The interaction model captures the invocations made by each method in the Component to other methods. Each interaction contains the package, the class in which the invoking method is in as well as the package, the class of the invoked function.
Definition 12. An interaction model (IN T) is a set of invocations where each invocation is a tuple, defined as IN V = hPf, Cf, MfPi, Ci, Mii, where Pf represents the package of the invoking function, Cf represents the class of the invoking function, Mf represents the invoking method, Pi represents the package of the invoked function, Ci represents the class of the invoked function, andMi represents the invoked function.
Here, we assume that the services are developed in Object Oriented Pro-gramming languages and thus the invocation model is designed to capture such interactions. However, conforming to this particular model is not a constraint that is forced on theCRT artefact.
ASecurity Problem Definition(spd) is essential in a security certificate as it provides the rationale for securing the assets. The rationale for securing the assets can stem from the threats that are identified for the assets by the service provider or from the service provider’s security policy (which in turn could be due to compliance to regulations etc.).
Definition 13. The security problem definition is a tuple spd = hA, spri,ˆ where A ⊆ Aˆ is a set of assets that need to be secured and spr is a security problem rationale for securing the assets.
Definition 14. The security problem rationale (spr) is a union of threats T and service provider’s security policySSP . spr =T ∪ SSP
The service description must contain the description of the certified sys-tem, the part of the system that is evaluated and the rationale for protecting the assets that are identified.
Definition 15. The Service Description is a tupleSD = hT OC,T OE,SPDi where,SPDis the set of security problem definitions(spd).