Formalizing Threat Models for Virtualized Systems - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Formalizing Threat Models for Virtualized Systems

Daniele Sgandurra
  • Fonction : Auteur
  • PersonId : 1022685
Erisa Karafili
  • Fonction : Auteur
  • PersonId : 1022686
Emil Lupu
  • Fonction : Auteur
  • PersonId : 1022687

Résumé

We propose a framework, called FATHoM (FormAlizing THreat Models), to define threat models for virtualized systems. For each component of a virtualized system, we specify a set of security properties that defines its control responsibility, its vulnerability and protection states. Relations are used to represent how assumptions made about a component’s security state restrict the assumptions that can be made on the other components. FATHoM includes a set of rules to compute the derived security states from the assumptions and the components’ relations. A further set of relations and rules is used to define how to protect the derived vulnerable components. The resulting system is then analysed, among others, for consistency of the threat model. We have developed a tool that implements FATHoM, and have validated it with use-cases adapted from the literature.
Fichier principal
Vignette du fichier
428203_1_En_18_Chapter.pdf (982.68 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01633687 , version 1 (13-11-2017)

Licence

Paternité

Identifiants

Citer

Daniele Sgandurra, Erisa Karafili, Emil Lupu. Formalizing Threat Models for Virtualized Systems. 30th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2016, Trento, Italy. pp.251-267, ⟨10.1007/978-3-319-41483-6_18⟩. ⟨hal-01633687⟩
73 Consultations
92 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More