@incollection{SchmidtHateburHeisel2018, author = {Schmidt, Holger and Hatebur, Denis and Heisel, Maritta}, title = {Developing Secure Software Using UML Patterns}, series = {Intelligent systems: Concepts, methodologies, tools, and applications}, booktitle = {Intelligent systems: Concepts, methodologies, tools, and applications}, publisher = {IGI Global}, address = {Hershey, Pennsylvania}, organization = {Management Association, Information Resources}, isbn = {9781522556435}, doi = {10.4018/978-1-5225-5643-5.ch022}, pages = {551 -- 592}, year = {2018}, language = {en} } @inproceedings{HateburHeiselSchmidt2007, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Security Engineering Process based on Patterns}, series = {18th International Workshop on Database and Expert Systems Applications (DEXA 2007)}, booktitle = {18th International Workshop on Database and Expert Systems Applications (DEXA 2007)}, publisher = {IEEE}, address = {Regensburg}, isbn = {978-0-7695-2932-5}, doi = {10.1109/DEXA.2007.36}, pages = {734 -- 738}, year = {2007}, abstract = {We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity.}, language = {en} } @inproceedings{CoteHateburHeiseletal.2008, author = {C{\^o}t{\´e}, Isabelle and Hatebur, Denis and Heisel, Maritta and Schmidt, Holger and Wentzlaff, Ina}, title = {A Systematic Account of Problem Frames}, series = {Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007.}, booktitle = {Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007.}, publisher = {Universit{\"a}tsverlag Konstanz}, address = {Konstanz}, pages = {749 -- 767}, year = {2008}, abstract = {We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development.}, language = {en} } @inproceedings{HateburHeiselSchmidt2006, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {Security Engineering Using Problem Frames}, series = {Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding}, volume = {LNCS, 3995}, booktitle = {Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding}, editor = {M{\"u}ller, G{\"u}nter}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-540-34640-1}, doi = {10.1007/11766155_17}, pages = {238 -- 253}, year = {2006}, language = {en} } @inproceedings{HateburHeiselSchmidt2007, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Pattern System for Security Requirements Engineering}, series = {The Second International Conference on Availability, Reliability and Security (ARES'07)}, booktitle = {The Second International Conference on Availability, Reliability and Security (ARES'07)}, publisher = {IEEE}, address = {Vienna}, isbn = {0-7695-2775-2}, doi = {10.1109/ARES.2007.12}, pages = {10}, year = {2007}, abstract = {We present a pattern system/or security requirements engineering, consisting of security problem frames and concretized security problem frames. These are special kinds of problem frames that serve to structure, characterize, analyze, and finally solve software development problems in the area of software and system security. We equip each frame with formal preconditions and postconditions. The analysis of these conditions results in a pattern system that explicitly shows the dependencies between the different frames. Moreover, we indicate related frames, which are commonly used together with the considered frame. Hence, our approach helps security engineers to avoid omissions and to cover all security requirements that are relevant for a given problem.}, language = {en} } @inproceedings{HateburHeiselSchmidt2008, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Formal Metamodel for Problem Frames}, series = {Model Driven Engineering Languages and Systems: 11th International Conference, MoDELS 2008, Toulouse, France, September 28 - October 3, 2008. Proceedings}, volume = {LNCS, 5301}, booktitle = {Model Driven Engineering Languages and Systems: 11th International Conference, MoDELS 2008, Toulouse, France, September 28 - October 3, 2008. Proceedings}, editor = {Czarnecki, Krzysztof and Ober, Ileana and Bruel, Jean-Michel and Uhl, Axel and V{\"o}lter, Markus}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-540-87874-2}, doi = {10.1007/978-3-540-87875-9_5}, pages = {58 -- 82}, year = {2008}, abstract = {Problem frames are patterns for analyzing, structuring, and characterizing software development problems. This paper presents a formal metamodel for problem frames expressed in UML class diagrams and using the formal specification notation OCL. That metamodel clarifies the nature of the different syntactical elements of problem frames, as well as the relations between them. It provides a framework for syntactical analysis and semantic validation of newly defined problem frames, and it prepares the ground for tool support for the problem frame approach.}, language = {de} } @inproceedings{HateburHeiselSchmidt2008, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {Analysis and Component-based Realization of Security Requirements}, series = {2008 Third International Conference on Availability, Reliability and Security}, booktitle = {2008 Third International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Barcelona}, isbn = {978-0-7695-3102-1}, doi = {10.1109/ARES.2008.27}, pages = {195 -- 203}, year = {2008}, abstract = {We present a process to develop secure software with an extensive pattern-based security requirements engineering phase. It supports identifying and analyzing conflicts between different security requirements. In the design phase, we proceed by selecting security software components that achieve security requirements. The process enables software developers to systematically identify, analyze, and finally realize security requirements using security software components. We illustrate our approach by a lawyer agency software example.}, language = {en} } @inproceedings{CoteHeiselSchmidtetal.2011, author = {C{\^o}t{\´e}, Isabelle and Heisel, Maritta and Schmidt, Holger and Hatebur, Denis}, title = {UML4PF — A tool for problem-oriented requirements analysis}, series = {2011 IEEE 19th International Requirements Engineering Conference}, booktitle = {2011 IEEE 19th International Requirements Engineering Conference}, publisher = {IEEE}, address = {Trento}, isbn = {978-1-4577-0924-1}, doi = {10.1109/RE.2011.6051670}, pages = {349 -- 350}, year = {2011}, abstract = {We present UML4PF, a tool for requirements analysis based on problem frames. It consists of a UML profile and an Eclipse-Plugin to model and analyze problem diagrams, derive specifications, and develop architectures.}, language = {en} } @inproceedings{HateburHeiselJuerjensetal.2011, author = {Hatebur, Denis and Heisel, Maritta and J{\"u}rjens, Jan and Schmidt, Holger}, title = {Systematic Development of UMLsec Design Models Based on Security Requirements}, series = {Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbr{\"u}cken, Germany, March 26-April 3, 2011. Proceedings}, volume = {LNCS, 6603}, booktitle = {Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbr{\"u}cken, Germany, March 26-April 3, 2011. Proceedings}, editor = {Giannakopoulou, Dimitra and Orejas, Fernando}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-19810-6}, doi = {10.1007/978-3-642-19811-3_17}, pages = {232 -- 246}, year = {2011}, language = {en} } @incollection{SchmidtHateburHeisel2011, author = {Schmidt, Holger and Hatebur, Denis and Heisel, Maritta}, title = {A Pattern-Based Method to Develop Secure Software}, series = {Software Engineering for Secure Systems: Industrial and Research Perspectives}, booktitle = {Software Engineering for Secure Systems: Industrial and Research Perspectives}, editor = {Mouratidis, Haralambos}, publisher = {IGI Global}, address = {Hershey}, isbn = {978-1-61520-837-1}, doi = {10.4018/978-1-61520-837-1.ch003}, pages = {32 -- 74}, year = {2011}, abstract = {The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components.}, language = {en} }