Skip to main content
Book cover

International Symposium on Architecting Critical Systems

ISARCS 2010: Architecting Critical Systems pp 1–18Cite as

An Architectural Framework for Analyzing Tradeoffs between Software Security and Performance

  • Conference paper

Part of the Lecture Notes in Computer Science book series (LNSC,volume 6150)

Abstract

The increasing complexity of software systems entails large effort to jointly analyze their non-functional attributes in order to identify potential tradeoffs among them (e.g. increased availability can lead to performance degradation). In this paper we propose a framework for the architectural analysis of software performance degradation induced by security solutions. We introduce a library of UML models representing security mechanisms that can be composed with performance annotated UML application models for architecting security and performance critical systems. Composability of models allows to introduce different security solutions on the same software architecture, thus supporting software architects to find appropriate security solutions while meeting performance requirements. We report experimental results that validate our approach by comparing a model-based evaluation of a software architecture for management of cultural assets with values observed on the real implementation of the system.

Keywords

  • performance
  • security
  • UML
  • GSPN
  • tradeoff analysis

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-642-13556-9_1
  • Chapter length: 18 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
eBook
USD   74.99
Price excludes VAT (USA)
  • ISBN: 978-3-642-13556-9
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   99.00
Price excludes VAT (USA)
Learn about institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. UML 2.0 Superstructure Specification, OMG document formal/05-07-04, Object Management Group (2005), http://www.omg.org/cgi-bin/doc?formal/05-07-04

  2. UML Profile for MARTE beta 2, OMG document ptc/08-06-09 (2008), http://www.omgmarte.org/Documents/Specifications/08-06-09.pdf

  3. Balsamo, S., Di Marco, A., Inverardi, P., Simeoni, M.: Model-based performance prediction in software development: A survey. IEEE TSE 30(5), 295–310

    Google Scholar 

  4. Blaze, M., Ioannidis, J., Keromytis, A.D.: Trust management for ipsec. ACM Transactions on Information and System Security 5(2), 95–118 (2002)

    CrossRef  Google Scholar 

  5. Cortellessa, V., Trubiani, C.: Towards a library of composable models to estimate the performance of security solutions. In: WOSP, pp. 145–156 (2008)

    Google Scholar 

  6. Cortellessa, V., Trubiani, C., Mostarda, L., Dulay, N.: An Architectural Framework for Analyzing Tradeoffs between Software Security and Performance - Extended results. Technical Report 001-2010, Dipartimento di Informatica - Università dell’Aquila (2010), http://www.di.univaq.it/cortelle/docs/001-2010-report.pdf

  7. European Commision 6th Framework Program. Cultural Heritage Space Identification System (CUSPIS), www.cuspis-project.info

  8. France, R.B., Ray, I., Georg, G., Ghosh, S.: Aspect-oriented approach to early design modelling. IEE Proceedings - Software 151(4), 173–186 (2004)

    CrossRef  Google Scholar 

  9. Gupta, V., Gupta, S., Shantz, S.C., Stebila, D.: Performance analysis of elliptic curve cryptography for SSL, pp. 87–94 (2002)

    Google Scholar 

  10. Harbiterr, A., Menasce, D.A.: A methodology for analyzing the performance of authentication protocols. ACM TISSEC (2002)

    Google Scholar 

  11. Hirel, C., Sahner, R., Zang, X., Trivedi, K.: Reliability and performability modeling using sharpe 2000. In: Haverkort, B.R., Bohnenkamp, H.C., Smith, C.U. (eds.) TOOLS 2000. LNCS, vol. 1786, pp. 345–349. Springer, Heidelberg (2000)

    CrossRef  Google Scholar 

  12. Juric, M.B., Rozman, I., Brumen, B., Colnaric, M., Hericko, M.: Comparison of performance of web services, ws-security, rmi, and rmi-ssl. Journal of Systems and Software 79(5), 689–700 (2006)

    CrossRef  Google Scholar 

  13. Jurjens, J.: Secure Systems Development with UML (2004)

    Google Scholar 

  14. Kant, K., Iyer, R.K., Mohapatra, P.: Architectural impact of Secure Socket Layer on internet servers, pp. 7–14 (2000)

    Google Scholar 

  15. Marsan, M.A., Balbo, G., Conte, G., Donatelli, S., Franceschinis, G.: Modelling with Generalized Stochastic Petri Nets, 4th edn. (November 1994)

    Google Scholar 

  16. Menascé, D.A.: Security performance. IEEE Internet Computing 7(3), 84–87 (2003)

    CrossRef  Google Scholar 

  17. Mostarda, L., Dong, C., Dulay, N.: Place and Time Authentication of Cultural Assets. In: 2nd Joint ITRUST and PST Conferences on Privacy, Trust and Security, IFIPTM 2008 (2008)

    Google Scholar 

  18. Stallings, W.: Cryptography and network security: Principles and Practice, 4th edn. Prentice-Hall, Englewood Cliffs (2006)

    Google Scholar 

  19. Tai, A.T., Meyer, J.F., Avizienis, A.: Software Performability: From Concepts to Applications. Kluwer Academic Publishers, Boston (1996)

    MATH  Google Scholar 

  20. Tawhid, R., Petriu, D.C.: Towards automatic derivation of a product performance model from a UML software product line model. In: WOSP, pp. 91–102 (2008)

    Google Scholar 

  21. Trivedi, K.: Sharpe interface, user’s manual, version 1.01. Technical report (1999), http://www.ee.duke.edu/~chirel/MANUAL/gui.doc

  22. Woodside, C.M., Petriu, D.C., Petriu, D.B., Xu, J., Israr, T.A., Georg, G., France, R.B., Bieman, J.M., Houmb, S.H., Jürjens, J.: Performance analysis of security aspects by weaving scenarios extracted from UML models. Journal of Systems and Software 82(1), 56–74 (2009)

    CrossRef  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Università degli Studi dell’Aquila, L’Aquila, Italy

    Vittorio Cortellessa & Catia Trubiani

  2. Imperial College London, London, United Kingdom

    Leonardo Mostarda & Naranker Dulay

Authors
  1. Vittorio Cortellessa
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Catia Trubiani
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Leonardo Mostarda
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Naranker Dulay
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Hasso Plattner Institute for Software Systems Engineering, Prof.-Dr.-Helmert-Str. 2-3, 14482, Potsdam, Germany

    Holger Giese

Rights and permissions

Reprints and Permissions

Copyright information

© 2010 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Cortellessa, V., Trubiani, C., Mostarda, L., Dulay, N. (2010). An Architectural Framework for Analyzing Tradeoffs between Software Security and Performance. In: Giese, H. (eds) Architecting Critical Systems. ISARCS 2010. Lecture Notes in Computer Science, vol 6150. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-13556-9_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-13556-9_1

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-13555-2

  • Online ISBN: 978-3-642-13556-9

  • eBook Packages: Computer ScienceComputer Science (R0)