Building a security reference architecture for cloud systems. Issue 2 (June 2016)

• Record Type: Journal Article
• Authors: Fernandez, Eduardo; Monge, Raul; Hashizume, Keiko
• Is Part Of: Requirements engineering. Volume 21:Issue 2(2016)
• Page Start: 225
• Page End: 249
• Publication Date: 2016-06
• Subjects: Security reference architecture -- Security patterns -- Reference architecture -- Security requirements -- Secure software development -- Cloud computing -- IaaS security; Requirements engineering -- Periodicals; Software engineering -- Periodicals; Computer software -- Development -- Periodicals; Logiciels -- Développement -- Périodiques; Génie logiciel -- Périodiques; 005.12
• DOI: 10.1007/s00766-014-0218-7
• Languages: English
• ISSNs: 0947-3602

Abstract

Abstract Reference architectures (RAs) are useful tools to understand and build complex systems, and many cloud providers and software product vendors have developed versions of them. RAs describe at an abstract level (no implementation details) the main features of their cloud systems. Security is a fundamental concern in clouds and several cloud vendors provide security reference architectures (SRAs) to describe the security features of their services. A SRA is an abstract architecture describing a conceptual model of security for a cloud system and provides a way to specify security requirements for a wide range of concrete architectures. We propose here a method to build a SRA for clouds defined using UML models and patterns, which goes beyond existing models in providing a global view and a more precise description. We present a metamodel as well as security and misuse patterns for this purpose. We validate our approach by showing that it can describe more precisely existing models and that it has a variety of uses. We describe in detail one of these uses, a way of evaluating the security level of a SRA.