Authors:
Azzam Mourad
;
Dima Alhadidi
and
Mourad Debbabi
Affiliation:
Computer Security Laboratory, Concordia Institute for Information Systems Engineering, Concordia University, Canada
Keyword(s):
Software Security, Aspect-Oriented Programming (AOP), AOP Weaving, Gimple Representation.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Secure Software Development Methodologies
;
Security Engineering
;
Security in Information Systems
;
Security Information Systems Architecture and Design and Security Patterns
Abstract:
In this paper, we propose an approach for weaving security concerns in the Gimple representation of programs. Gimple is an intermediate, language-independent, and tree-based representation generated by GNU Compiler Collection (GCC) during the compilation process. This proposition constitutes the first attempt towards adopting the aspect-oriented concept on Gimple and exploiting this intermediate representation to allow advising an application written in a specific language with security code written in a different one. At the same time, injecting security is applied in a systematic way in order not to alter the original functionalities of the software. We explore the viability and the relevance of our proposition by: (1) implementing several Gimple weaving capabilities into the GCC compiler (2) developing a case study for securing the connections of a client application and (3) using the weaving features of the extended GCC to inject the security concerns into the application.