Abstract
The increasing complexity of software systems entails large effort to jointly analyze their non-functional attributes in order to identify potential tradeoffs among them (e.g. increased availability can lead to performance degradation). In this paper we propose a framework for the architectural analysis of software performance degradation induced by security solutions. We introduce a library of UML models representing security mechanisms that can be composed with performance annotated UML application models for architecting security and performance critical systems. Composability of models allows to introduce different security solutions on the same software architecture, thus supporting software architects to find appropriate security solutions while meeting performance requirements. We report experimental results that validate our approach by comparing a model-based evaluation of a software architecture for management of cultural assets with values observed on the real implementation of the system.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
UML 2.0 Superstructure Specification, OMG document formal/05-07-04, Object Management Group (2005), http://www.omg.org/cgi-bin/doc?formal/05-07-04
UML Profile for MARTE beta 2, OMG document ptc/08-06-09 (2008), http://www.omgmarte.org/Documents/Specifications/08-06-09.pdf
Balsamo, S., Di Marco, A., Inverardi, P., Simeoni, M.: Model-based performance prediction in software development: A survey. IEEE TSE 30(5), 295–310
Blaze, M., Ioannidis, J., Keromytis, A.D.: Trust management for ipsec. ACM Transactions on Information and System Security 5(2), 95–118 (2002)
Cortellessa, V., Trubiani, C.: Towards a library of composable models to estimate the performance of security solutions. In: WOSP, pp. 145–156 (2008)
Cortellessa, V., Trubiani, C., Mostarda, L., Dulay, N.: An Architectural Framework for Analyzing Tradeoffs between Software Security and Performance - Extended results. Technical Report 001-2010, Dipartimento di Informatica - Università dell’Aquila (2010), http://www.di.univaq.it/cortelle/docs/001-2010-report.pdf
European Commision 6th Framework Program. Cultural Heritage Space Identification System (CUSPIS), www.cuspis-project.info
France, R.B., Ray, I., Georg, G., Ghosh, S.: Aspect-oriented approach to early design modelling. IEE Proceedings - Software 151(4), 173–186 (2004)
Gupta, V., Gupta, S., Shantz, S.C., Stebila, D.: Performance analysis of elliptic curve cryptography for SSL, pp. 87–94 (2002)
Harbiterr, A., Menasce, D.A.: A methodology for analyzing the performance of authentication protocols. ACM TISSEC (2002)
Hirel, C., Sahner, R., Zang, X., Trivedi, K.: Reliability and performability modeling using sharpe 2000. In: Haverkort, B.R., Bohnenkamp, H.C., Smith, C.U. (eds.) TOOLS 2000. LNCS, vol. 1786, pp. 345–349. Springer, Heidelberg (2000)
Juric, M.B., Rozman, I., Brumen, B., Colnaric, M., Hericko, M.: Comparison of performance of web services, ws-security, rmi, and rmi-ssl. Journal of Systems and Software 79(5), 689–700 (2006)
Jurjens, J.: Secure Systems Development with UML (2004)
Kant, K., Iyer, R.K., Mohapatra, P.: Architectural impact of Secure Socket Layer on internet servers, pp. 7–14 (2000)
Marsan, M.A., Balbo, G., Conte, G., Donatelli, S., Franceschinis, G.: Modelling with Generalized Stochastic Petri Nets, 4th edn. (November 1994)
Menascé, D.A.: Security performance. IEEE Internet Computing 7(3), 84–87 (2003)
Mostarda, L., Dong, C., Dulay, N.: Place and Time Authentication of Cultural Assets. In: 2nd Joint ITRUST and PST Conferences on Privacy, Trust and Security, IFIPTM 2008 (2008)
Stallings, W.: Cryptography and network security: Principles and Practice, 4th edn. Prentice-Hall, Englewood Cliffs (2006)
Tai, A.T., Meyer, J.F., Avizienis, A.: Software Performability: From Concepts to Applications. Kluwer Academic Publishers, Boston (1996)
Tawhid, R., Petriu, D.C.: Towards automatic derivation of a product performance model from a UML software product line model. In: WOSP, pp. 91–102 (2008)
Trivedi, K.: Sharpe interface, user’s manual, version 1.01. Technical report (1999), http://www.ee.duke.edu/~chirel/MANUAL/gui.doc
Woodside, C.M., Petriu, D.C., Petriu, D.B., Xu, J., Israr, T.A., Georg, G., France, R.B., Bieman, J.M., Houmb, S.H., Jürjens, J.: Performance analysis of security aspects by weaving scenarios extracted from UML models. Journal of Systems and Software 82(1), 56–74 (2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Cortellessa, V., Trubiani, C., Mostarda, L., Dulay, N. (2010). An Architectural Framework for Analyzing Tradeoffs between Software Security and Performance. In: Giese, H. (eds) Architecting Critical Systems. ISARCS 2010. Lecture Notes in Computer Science, vol 6150. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-13556-9_1
Download citation
DOI: https://doi.org/10.1007/978-3-642-13556-9_1
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-13555-2
Online ISBN: 978-3-642-13556-9
eBook Packages: Computer ScienceComputer Science (R0)