Software Architectural Design Meets Security Engineering

Security requirements strongly influence the architectural design of complex IT systems in a similar way as other non-functional requirements. Both security engineering as well as software engineering provide methods to deal with such requirements. However, there is still a critical gap concerning the integration of the methods of these separate fields. In this paper we close this gap with respect to security requirements by proposing a method that combines software engineering approaches with state-of-the-art security engineering principles. This method establishes an explicit alignment between the non-functional goal, the principles in the field of security engineering, and the implementation of a security architecture. The method aims at designing a system’s security architecture based on a small, precisely defined, and application-specific trusted computing base. We illustrate this method by means of a case study which describes distributed enterprise resource planning syst...

• Type: Conference
• Year: 2009
• Where: ECBS
• Authors: Stephan Bode, Anja Fischer, Winfried E. Kühnhauser, Matthias Riebisch
• Keywords: ECBS 2009, Hardware, Security Engineering, Security Requirements, Software Engineering