The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures
Alessandro Armando
(1)
,
Wihem Arsac
(2)
,
Tigran Avanesov
(3)
,
Michele Barletta
(4)
,
Alberto Calvi
(4)
,
Alessandro Cappai
(1)
,
Roberto Carbone
(1)
,
Yannick Chevalier
(5)
,
Luca Compagna
(2)
,
Jorge Cuellar
(6)
,
Gabriel Erzse
(7)
,
Simone Frau
(8)
,
Marius Minea
(7)
,
Sebastian Modersheim
(9)
,
David von Oheimb
(6)
,
Giancarlo Pellegrino
(2)
,
Serena Elisa Ponta
(1, 2)
,
Marco Rocchetto
(4)
,
Michaël Rusinowitch
(3)
,
Mohammad Torabi Dashti
(8)
,
Mathieu Turuani
(3)
,
Luca Vigano
(4)
1
DIST -
Dipartimento di Informatica, Sistemistica e Telematica
2 SAP Research [Sophia Antipolis]
3 CASSIS - Combination of approaches to the security of infinite states systems
4 UNIVR | DI - Department of Computer Science [Verona]
5 IRIT-LILaC - Logique, Interaction, Langue et Calcul
6 Siemens AG Corporate Technology - Software and System Architectures
7 UPT - Universității Politehnica Timișoara [România] = Polytechnic University of Timişoara [Romania] = Université polytechnique de Timișoara [Roumanie]
8 D-INFK - Department of Computer Science [ETH Zürich]
9 IBM Research Laboratory [Zurich]
2 SAP Research [Sophia Antipolis]
3 CASSIS - Combination of approaches to the security of infinite states systems
4 UNIVR | DI - Department of Computer Science [Verona]
5 IRIT-LILaC - Logique, Interaction, Langue et Calcul
6 Siemens AG Corporate Technology - Software and System Architectures
7 UPT - Universității Politehnica Timișoara [România] = Polytechnic University of Timişoara [Romania] = Université polytechnique de Timișoara [Roumanie]
8 D-INFK - Department of Computer Science [ETH Zürich]
9 IBM Research Laboratory [Zurich]
Tigran Avanesov
- Fonction : Auteur
- PersonId : 767405
- IdRef : 155909738
Yannick Chevalier
- Fonction : Auteur
- PersonId : 741963
- IdHAL : yannick-chevalier-cs
- ORCID : 0000-0002-8617-4209
- IdRef : 076752801
Michaël Rusinowitch
- Fonction : Auteur
- PersonId : 5215
- IdHAL : michael-rusinowitch
- IdRef : 029609135
Mathieu Turuani
- Fonction : Auteur
- PersonId : 755713
- IdRef : 079451284
Résumé
The AVANTSSAR Platform is an integrated toolset for the formal specification and automated validation of trust and security of service-oriented architectures and other applications in the Internet of Services. The platform supports application-level specification languages (such as BPMN and our custom languages) and features three validation backends (CL-AtSe, OFMC, and SATMC), which provide a range of complementary automated reasoning techniques (including service orchestration, compositional reasoning, model checking, and abstract interpretation). We have applied the platform to a large number of industrial case studies, collected into the AVANTSSAR Library of validated problem cases. In doing so, we unveiled a number of problems and vulnerabilities in deployed services. These include, most notably, a serious flaw in the SAML-based Single Sign-On for Google Apps (now corrected by Google as a result of our findings). We also report on the migration of the platform to industry.