ETD system

Electronic theses and dissertations repository

 

Tesi etd-12022011-163450


Thesis type
Tesi di dottorato di ricerca
Author
COSTA, GABRIELE
URN
etd-12022011-163450
Title
On the Security of Software Systems and Services
Settore scientifico disciplinare
INF/01
Corso di studi
INFORMATICA
Commissione
tutor Prof. Degano, Pierpaolo
relatore Dott. Martinelli, Fabio
Parole chiave
  • system verification
  • Language-based security
  • runtime monitoring
Data inizio appello
22/12/2011;
Consultabilità
completa
Riassunto analitico
This work investigates new methods for facing the security issues and threats arising from the composition of software. This task has been carried out through the formal modelling of both the software composition scenarios and the security properties, i.e., policies, to be guaranteed.<br>Our research moves across three different modalities of software composition which are of main interest for some of the most sensitive aspects of the modern information society. They are mobile applications, trust-based composition and service orchestration.<br>Mobile applications are programs designed for being deployable on remote platforms. Basically, they are the main channel for the distribution and commercialisation of software for mobile devices, e.g., smart phones and tablets. Here we study the security threats that affect the application providers and the hosting platforms. In particular, we present a programming framework for the development of applications with a static and dynamic security support. Also, we implemented an enforcement mechanism for applying fine-grained security controls on the execution of possibly malicious applications.<br>In addition to security, trust represents a pragmatic and intuitive way for managing the interactions among systems. Currently, trust is one of the main factors that human beings keep into account when deciding whether to accept a transaction or not. In our work we investigate the possibility of defining a fully integrated environment for security policies and trust including a runtime monitor.<br>Finally, Service-Oriented Computing (SOC) is the leading technology for business applications distributed over a network. The security issues related to the service networks are many and multi-faceted. We mainly deal with the static verification of secure composition plans of web services. Moreover, we introduce the synthesis<br>of dynamic security checks for protecting the services against illegal invocations.
File