Security Benefits from Software Architecture

(1)

HAL Id: inria-00073576

https://hal.inria.fr/inria-00073576

Submitted on 24 May 2006

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci-

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents

Christophe Bidan, Valérie Issarny

To cite this version:

Christophe Bidan, Valérie Issarny. Security Benefits from Software Architecture. [Research Report]

RR-3114, INRIA. 1997. �inria-00073576�

(2)

a p p o r t

d e r e c h e r c h e

INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE

Security Benefits from Software Architecture

Christophe Bidan & Val´erie Issarny

N ˚ 3114

F´evrier 1997

TH `EME 1

(3)

(4)

-./1032145!6.+7980;:<=?>A@B<DCE7F/1037HG2I2</I=KJ

LNMKO

P1QRPSTVUXWPIYZPI[]\_^`PbaYZc_Yda

O

P1QRPeY

f gihj

P1ak h]lnmno_hpg

U[]qrq h]g

a o P g Pes

M P g s M

PutBvpwrS]SIx9Tzy{WP1|

gim

P g

SI}]}~TV]q[pPIY

+I1r]]

tRa h_o

[c!Y+DP loRho_m

Ya gimn

\_aZP o Y

h]

ad,[

g

P[

g s Mrm

aZPesai\

g

PeY+a M P g P m

Y [trPIP ohpg

P1t|

mgih

t_

QRPItpaYB[

llnh

m tXa

M

PPe[]YZc

o

PI|]P lnh

qQPItFa h

[qq lm

s1[a mnh

tYBs

h

tDY

m

Yda

m

t

hM

PbaiP gih

pP1trP

h

\Y$Y h

adN[

g P

Q

h_o

\ l PIYN[]t

o`M

[|

m

tr{|[

gimnh

\Y\[

lnm

adc h]

kP g | m

sbP

g

Pep\

mg

P1QRP1tFaYPpD a

m

QRP lm

trPIYiYI [|[

ml

[

rmnlnm

adc h]g

YZPIs1\

gim

adcr¡Rkc_YdaiP1Q¢s1\Ya h Q

mn£

[a mnh

t9\Y

m

tr¤Q mnororl

PI,[

g

P1¥YZP g | m

s1PIY

m

Y[¤q gih

Q mY m tr¤Y

h]l

\_a mh

tHa h*o

Pe[

l

ma M a M P¦s

h

Pb^

m

YdaiP1ts1P h]

QB\

la mq l

P¦[]qrq lnm

sI[a mnh

tDY ma

MXorm¨§

P g

P1tFa\[

lnm

adc h

k_P g | m

sbP

g

PeF\

mg

P1QRPItpaY1

y

gZh

Qa

M

PRYPesb\

gim

adc¤q h]m

tpa h

| m P1$ a

M

P

h [ l©h]g

YZc_YdaiP1Qªsb\DYda h Q

m£

[a mh

t m Ya

h

qDP g Q m

aa M P m

t_

aiP gih

qP

g

[a mh

t`[Q

h

tr[qrq lnm

s1[a mh

tY

M

[|

m

tr

o_m¨§

P g P1tFae Fq

h

YiY mrl

c m ts

h

tY

m

YaZP1tFaNYPesb\

gim

adcRs

h

tYa g [ m

tpaY1

LNMm

Yq[qP go

PIQ

h

tYa

g

[aZPeY Mh

«a

M

PY h]

ad,[

g

PB[

g s Mm

aiPIsai\

g

P{q[

g [ orm

pQ mY

PItrPbDs m[

l+h]g

[

oro_g

PIYiY

m

trYPesb\

gim

adc

m

YiY\rPeY mt

o_m

Ya gimn

\_aZP

o

YZc_YdaiP1Q¬Ya Mrgih

\r

M

YZc_YdaiP1Q'sb\DYda h Q

m£

[a mh

tK

LNM

PRY h]

ad,[

g

PB[

g

s

Mm

aiPIsai\

g

Pq[

g [ o_m

]Qª[

lnlh

Ya

M

P¬[qrq lnm

s1[a mh

t o PI|]P

lh

qDP g a h [

Ya

g

[]sa

l

c*YZqDPes m

cYZPIsb\

gZm

adcF

g P l

[aiP

o

g

PIF\

mng

P1QRP1tFaiYI

LNM

P1tK h \

g g

[QRP1

h]gi®

ai[

®

PIY

m

t¤s M [ g

]PNa

M

P¦YZc_YdaiP1Q¯sb\DYda h Q

m£

[a mh

t¬a

h

QPIPba,a

M

PeYP

g

PIF\

mng

P1QRP1tFaiYI

LNM

P$q

g

[]sa

m

sI[

l

\YZP h°h

\ g [qq

gZh

[]s M`m

Y[

lY h [ oro_g

PIYiYP o`

c

o_m

Yisb\YiY

m

tr

m

aY

m

tpaiP1

g

[

a

mh

t m

t*[*±i²³I´+µ¶_·Z¸¹;º»²³¼½¸¾1¿À o_m

Yda gZmn

\_aiP o q

gih

g []QQ

m

trP1t|

mgih

trQRPItpae

Á*ÂFÃ!ÄiÅBÆ Ç+]

kPIs1\

gZm

adc] !kc_YdaiP1QÈsb\Ya h Q

m£

[a mnh

t© k h]

ad,[

g

P$[

g s Mrm

aZPesaZ\

g

Pp kqPIs

m

DsI[a mh

t¤Q¬[ais M

m

trD

ÉÊË

ÌZÍ3ÎeÏ

Ë

ÌÐ+ÑnÍ¥Ò3ÓbÔ

(5)

Â Â

P

o_h

Q¬[

m

trP

o

PIY[

g s Mrm

aZPesaZ\

g

PeY lnh

ms mP ll

PIY¦[[]\

jdh

\

go

M \ m

PeY hpm

t o \tP1t|

mngZh

trtrPb

QRPItpa

[]s mlnm

ai[tFa

lP o WPI|]P lh

qrqDPIQRP1tFa

o

PeY[]qrq lnm

sI[a mh

tYs

h

QRq

h

Y_WP1PeY

o

P¤Q h_o

\ l PeY

lnh

ms mP lY M WP1arWP gZh

O

P1tPIYI Pba [cF[tFa orm¨§

W

P g P1tFaiPIYPb^

m

]PItsbPeYP1tRaZP

g

QRPeY

o

PF\[

lnm

arWP o PYZP

g | m

s1PIYPpD ]aZPIQqDY o P g WP1q

h

tDYPp

orm

YZq h t

mnrmlnm

arWP h

\Y_WPIs1\

gim

arWPe¡b

[YqNWPIs m[

lm

YZ[a mnh

t o PeY YZc_Yda

O

P1QRPIY

o Pb^ WPIs1\_a mnh

teº»¸

l\_a mlnm

Yi[a mh

t o PYP

g

| m

sbPeYº»ÀpÀ ¿!)¸·Z¿BPIYa{\rtrP`Y h]l

\_a mnh

t q gih

QRP1aaZPI\YZPq h \ g

Y\qrq hpg

aiP g$l

[s

h

Pb^

m

YdaiP1ts1P

o

P¬QB\

la mq l

PIY

[]qrq lnm

sI[a mh

tYN[|]PIs o_m§

W

P g P1tFaZPeY,Pb^

m

pP1ts1PIYNPItaiP

g

QPeY

o

P{F\[

lnm

arWP o P$YZP

g | m

sbPeY1

" \ q hpm

tFa

o

PR|\rP o P l

[Y_WPIs1\

gZm

arWP mt

h]g

QR[a

m

F\rP]

l h]_j

Pesa m,o

P l [YqNWPIs

m[ lm

YZ[a mnh

t o P`YZc_Yda

O

P1QRPeY

PeYda

o

P¤qDP

g

QRP1aa g P lm

tFaiP gih

qNWP g [a

mnh

t PItpa

g

P[qq lm

s1[a mnh

tY[cp[]tFa o_m§

W

P g P1tFaZPeYs

h

tFa g [ m

tFaZPIY

o

P*Y_WPIsb\r

gim

arWP P1|pP1tFaZ\PW lnl

PIQPItFa

m

ts

h

QRq[a mrl

PIYI$# PRq[q mP g Q h

tFa

g

PRs

h

QRQRP1tFa

l

PIY$[

g s Mrm

aZPesaZ\

g

PeY lnh

ms mP ll

PIY

qP1\|]P1tFa$%Pba

g

P`\ra mnlm

Y_WP1PIYq h \

gl

m tparWP1

g

[a mnh

t o P l[ Y_WPIsb\

gZm

arWP o [tY

l

PeYYZc_Yda

O

P1QRPeY o_m

Yda gZmn

\NWPIY$Iº»¸

l[

YZqNWPes m[

lnm

Yi[a mh

t o PIYYZc_Yda

O

P1QRPeY

o Pb^ WPIs1\_a mnh

t

PIY[

g s Mrm

aiPIsbaZ\

g

PIY lnh

ms mP ll

PIYqDP

g

QRPbaZaZPItpa[\_^

o WPI|]P1

lnh

qqDPI\

g Y o [qrq lm

s1[a mnh

tY o P YZqNWPes

m

P g+o

P)Q¬[t m;O

P g P [ Ya

g [ m

aZP

l

P1\

g

Y°Pb^

m

]P1tDsbPIY©P1t$aiP

g

QRPIY o P Y_WPIs1\

gim

arWP

mt

hpg

Q¬[a

m

F\rPp'&

h a g

P,P1t|

mgih

trtP1QRP1tFa°qP1\ra[

lhpg

Y+YZq,WPIs m[

lm

YZP g©l

PNYc_Ya

O

PIQP

o Pb^ WPIs1\_a mnh

tBq h \ g

p[

g

[tr

a

mg

s1PIY+Pb^

m

]P1tDsbPIYI

\ra mnlm

YZ[a mnh

tq

g

[a

m

F\rP

o

PNt

h a g P []qrq gih

s M P PeYdaBWP1F[

l

P1QRP1tFaKa g [ m

arWP1P P1tq gZh

q h YZ[]tFa

Y h t m tparWP1

g

[a mnh

t o

[tYN\rtPItF|

mngZh

trtrPIQPItFa

o

P$q gZh

g [QRQ¬[a

mh

t

o_m

Yda gZmn

\NWPIPqD[

g s h

t_p\

g

[a mnh

tK

( Æ e Ä *) Â k WPesb\

gim

arWP mt

hpg

Q¬[a

m

p\P] YZqNWPes m[

lnm

Yi[a mh

t o P{YZcYa

O

P1QRP] r[

g s Mrm

aZPesai\

g P lnh

ms mP ll

P] r[]qrq[

gim

P1QRP1tFa

o

P{YZq,WPIs

m

s1[a mh

tY

h]g

QP ll

PIYI

(6)

+ H,b

"

\rP9a h aM

P9q gZh

g PIYiY

mt s h

QRqr\_aiP

g

YZs

m

PItsbPp

h

qDPIt o_m

Ya gim

\raZP o s h

QRqr\_a

m

tr Yc_YaZPIQRY[

g

P9t h

P

lm

mnrl

P

h]g

Y\rqq hpg

a m tr{[{

mno

Ps

l

[]YiY h

[qq lm

s1[a mnh

tYI

M

[|

m

tr

o_m§

P g

P1tFaN\[

lm

adc h]

k_P g | m

sbP{¥

h

kr¡

g

PIF\

mng

P1QRP1tFaiYB»YZ\s

M

[]YNa

m

QRP lm

trPIYiYI D[|[

mnl

[

rmnlm

adc hpg

YPesb\

gim

adc_¡btrP$q gih

Q mY m tr`[qrq

gZh

[]s M a

ho

Pe[

l

ma M a M P s h Pb^

m

YdaiP1ts1P h

Q\

la mq lP [qq lm

s1[a mnh

tY

ma M?o_m§

P g P1tFa*

h k g

Pep\

mg

P1QRP1tFaY

m

YXYZc_YdaiP1Q

s1\Ya h Q

mn£

[a mnh

t \Y

m

tr Q moro_l

P1N[

g

PbYP g | m

sbPIYx¥

t hpgio

P g ah Mrmo P*a

M

PHsb\DYda h Q

m£

[a mh

t q gZh

sbPeYZY

gih

Q'[]qrq lnm

sI[a mh

t o P1|pP

lnh

qP

g

Y1 !,PtP1P o [

g

[]QPI

hpgZ®

a h YZqDPes

m

c9

h k g

PIF\

mng

P1QRP1tFaiYa

M

[aai[

®

PIY

m

ts M [ g

pP¦a

M

PYc_YaZP1Qªs1\Yda h Q

mn£

[a mh

t c¤YZP

l

PIsba

m

tr[qq gZh

q

gim

[aZP$Q mnoo_l

PI,[

g

P1¥YZP g | m

s1PIYS¥

LNM

P

Y

h

adN[

g

P[

g s Mrm

aiPIsbaZ\

g

PDP lo

q

gZh

|

mo

PIYN[t[

o

PIF\[aiP

[]Y

m

Y,a

h

Y\qrq hpg

aYZ\s M [

g

[QRPI

hpgZ®

LNM

P{Y h

adN[

g

P¦[

g s Mm

aiPIsai\

g

PDP loXM

[]YNP1QRP

g

pP oXm

t

h]go

P g a h PI[pYP¦a

M P o

P1|pP lnh

qrQRPItpa h]

s h QRq

l

Pb^

[]qrq lnm

sI[a mh

tY

h]g

Y

h]

ad,[

g

PYc_YaZP1Q¬Y¡

c

h

YdaiP gim

trY h]

ad,[

g P g

P13\YZP] FP1|

h]l

\_a mnh

t© []t[

l

c_Y

m

YI F[]t

o

Q¬[

tD[]PIQRP1tFa{P]n r D¡

la Mrh

\r

M a M

PBY h

adN[

g

P¦[

g s Mrm

aZPesai\

g

P¦P lno¤m

Ys

h

tFa

m

tF\

h

\Y

l

cP1|

hpl

| m tr

a M Ps

l

Pe[t YPIq[

g

[a mh

t

Pbad,P1PIt Y h]

ad,[

g

P*s

h

QRq

h

trP1tFaiYP]«s

h

QRqr\_ai[a mnh

t[

l

\rt

m

aiY¡`[]t o aM P

mg

m

tFaZP

g

[psa mnh

tDY

m

Y

mo

P l

c[]sIsbPIq_aZP o

t9a

M

[a

g

[QRP1

h]gi®

![]t·i±_º¹¥¿±1¹;¶_·Z¿¿b¾1±b·º !¹;º»²³"!°¸³Fµ]¶¸1µF¿

#%$'&p¡,[

llnh

YNYc_YaZP1Q YqPIs

m

s1[a mh

tY

m

taiP

g

QRY h

a M Pa

Mg

PIP

h]lnlh

m trR[

Ya

g

[]sba mnh

tY(*)

+º,.- ² r²³¿1³¹;¾a

M

[a[

Ya

g

[]sa lc o

P1trP¬s

h

QRqr\_ai[a mnh

t[

l

\t

m

aY

gZm

aaiP1t

mt [tcq

gih

g [QRQ

m

tr

l

[]tr]\D[]Pp

+ ºº,.- ²³³!¿±b¹²·¾Ka

M

[a [

Yda

g

[psa lc o

P1trP,adcqDPeY hm

tFaZP

g

[]sba mnh

tY,PpD ]q

m

qP] ps lnm

PItpaZ¥YZP

g

|]P

g

¡©[Q

h

t

s h Qq

h

tP1tFaiYI r[t

o

+ººº,.- ²³I´+µ¶_·i¸¹3º»²³a

M

[a

o

PbDtrPIY$[¤Yc_YaZPIQ¢Yda

g

\DsaZ\

g

P*

mP]n ©[Y h]

ad,[

g

P[

g s Mrm

aiPIsbaZ\

g

Pe¡

mt aZP

g

Q¬Y

h

a M P m tFaZP

g s h

trtrPesa mh

t

h]

s h QRq

h

trP1tFaiY,a Mrgih

\r

M s h

trtrPesa h]g

Y1

# h trtrPesa

hpg

Y{QR[c

PX|

m

PI P o [pY$a

M

PXµ*¶¿$a

M

[a

rm

t o Y{a

M

Ps

h

QRq

h

trP1tFaY0/a

M

P1c

o

P1trP¬a

M

PXYZPba h]

·i² ¿b¾a

M

[aa

M

Ps

h

QRq

h

trPItpaY¬QB\DYda`q

l

[c a h s h

QRQB\rt

m

s1[aZPp )a

M

[a

m

Y¬a

h

YZ[cp )a

M

PYZPba h]

!·Z² ¿1·¼

¹3º»¿b¾ h]

N[]t

o

·Z¿¸¹3º»²³¾1º []Q

h

trD a M Ps

h

QRq

h

trP1tFaY2_ ,3 S4¥ UPe[]Y

h t m

tr [aa

M P l

P1|pP lh]

Y

h

adN[

g

P[

g s Mrm

aZPesai\

g

PeY{q gih

|

mno

PIYBa

M

P[

o

PeF\[aiP¤[

Yda

g

[psa mh

tY

hpg

YZc_YdaiP1Q sb\DYda h Q

m£

[a mh

t \Y

m

tr

Q

moro_l

P1N[

g

Pb YP g | m

sbPeY0)*

h k q gZh

qDP ga m

PeY¬s1[]t

P*q gih

|

mo

P o c [ sbP

g

a[

mt adcqP h

s h ttrPIsba

h]g

Y mt

Mm

s

MXgZhpl

PeY

m

ts l\ o

P$YZqDPes

m

Ds1[a mnh

tY h]

h kF

g P l

[aZP o s h

trtrPesa hpg P M

[|

mnh]g

YI'5 h]gi®Rm

tXa

M

P$Y h

adN[

g P

[ g s Mm

aiPIsai\

g P g

PeYPe[

g s M

DP lo M

[]Y

P1P1t s h tDsbP1tFa

g

[a

m

tr

h t a M

PYqPIs

m

DsI[a mh

tY h]

s h QRQ\rt

m

s1[a mh

t

[ g s Mm

aiPIsai\

g

PIYI a

M

[a

m

Ya

h

Yi[c] Da

M

P¬s

h

QRQB\rt

m

sI[a mnh

tq gZh

a h s hpl

\DYP oh]gM

[]t o_lnm

tr¤s

h

Qq

h

tP1tFa

m

t_

aiP

g

[]sba mnh

tY»P]q

m

QPIQ h]g

c_¡; S03<5 M P g

PI[pYa M P g P P g

PItsbP o

h]gi®{h

s1\YPeY h t

[]qrq lnm

sI[a mh

t{s

h

QRQ\rt

m

s1[a mh

t$q[aZaZP

g

tYI P [ g P)s

h

tsbP

g

trP

o ma M a M

PN

h

ka

M

[a

m

Y©p\[

g

[tFaZPIP o M

PIt

\DY

m

tr[`

m

|]PIt s h trtrPesa

h]g

{

h

kF

g P l

[aZP

o

sb\Ya h Q

mn£

[a mnh

tsI[t

PR[]s Mrm

P1|pP

o

[pY

h]lnlh

YI{y mg

Ydae !a M P

[]qrq lnm

sI[a mh

t h k g

PIF\

mng

PIQRP1tFaiY$[

g P o

P1trP o ma

Mrm

t9a

M

PXYqPIs

m

DsI[a mh

tY h

s h trtrPIsba

hpg

Y¦q gih

|

mno

P o

a M [a¦PI[ps

M*m

tFaZP

g

[psa mh

t m Y¦s

M [ g

[psaZP gZmn£

P

o¤

c*[¬\t

m

F\rPRs

h

trtrPesa hpg

"

\[

ll

c] ½¸¾1¿¬±²³D³¿±1¹¥²·¾$

mP]n

s h trtPIsa

h]g

Y+a

M

[a [ g P[|[

mnl

[

rl

P,

ma Mm

t¬a

M

PPItF|

mngZh

trQRP1tFa¡[]t

o

¾=¾¹¿¼¿¿D¾1²>¹!)¸·Z¿$±² ²³¿1³¹;¾

mP]n rQ moro_l

P1N[

g

Pb YP g | m

sbPIY¡

o

PIs l[ g

P¦a

M

PB

h

k`q gih

qP ga m

PIY,a

M

P1cXq gih

|

mo

Pp

LNM

PItK r

m

|pP1tXa M P

hpg

Q¬[

l

YZqPIs

m

DsI[a mnh

tDY h

h kq

gih

qP g a m

PIYI pY h

adN[

g

PYqPIs

m

DsI[a mh

tQ¬[ais Mrm

tr?wp4

m

Y\DYP o a

h$g

Pba gim

P1|]P[$YZPba

h]

Yc_YaZPIQ

l

P1|]P l Y

h

adN[

g

P{s

h

QRq

h

trP1tFaiYa

h

]P1a

M P g ma M

[pYP¡s

h

trtrPesa h]g

Y1 !Y h a M

[aa

M

Ps h t j

\ts

a

mh

t

h

a M P mg

h kRq

gZh

qDP ga m

PeY)Q¬[as

M

PIY)a

M

P¦[]qrq lnm

sI[a mnh

t g PIF\

mng

P1QRP1tFaiY S1x@¥

LNM

P¦s

h

trtPIsa h]g \

mnl

a