A Taxonomy for Security Flaws in Event-Based Systems

Youn Kyu Lee,Dohoon Kim

doi:10.3390/app10207338

Abstract

Event-based system (EBS) is prevalent in various systems including mobile cyber physical systems (MCPSs), Internet of Things (IoT) applications, mobile applications, and web applications, because of its particular communication model that uses implicit invocation and concurrency between components. However, an EBS’s non-determinism in event processing can introduce inherent security vulnerabilities into the system. Multiple types of attacks can incapacitate and damage a target EBS by exploiting this event-based communication model. To minimize the risk of security threats in EBSs, security efforts are required by determining the types of security flaws in the system, the relationship between the flaws, and feasible techniques for dealing with each flaw. However, existing security flaw taxonomies do not appropriately reflect the security issues that originate from an EBS’s characteristics. In this paper, we introduce a new taxonomy that defines and classifies the particular types of inherent security flaws in an EBS, which can serve as a basis for resolving its specific security problems. We also correlate our taxonomy with security attacks that can exploit each flaw and identify existing solutions that can be applied to preventing such attacks. We demonstrate that our taxonomy handles particular aspects of EBSs not covered by existing taxonomies.

Highlights

Platforms [1] have been widely used in mobile cyber physical systems (MCPSs) as well as a wide range of applications including Internet of Things (IoT) [2,3,4,5], financial markets, logistics, and web apps [6], including those that directly interfaced with users (e.g., Android apps [7])
Our taxonomy covers all types of security flaws discovered in Event-based system (EBS) so far and even handles additional security flaws not covered by existing taxonomies
To validate our taxonomy in terms of coverage, two different types of evaluation were required: (1) completeness: if it covers all types of security flaws in EBSs; and (2) originality: if it handles particular types of security flaws not covered by existing listings or taxonomies

Summary

Introduction

Event-based systems (EBSs) developed by using message-oriented middleware (MOM)platforms [1] have been widely used in mobile cyber physical systems (MCPSs) as well as a wide range of applications including Internet of Things (IoT) [2,3,4,5], financial markets, logistics, and web apps [6], including those that directly interfaced with users (e.g., Android apps [7]). Event-based systems (EBSs) developed by using message-oriented middleware (MOM). In the case of MCPSs, for example, since they integrate distributed entities including computational, communication, and physical components [8], event-based architecture has been considered as an appropriate mechanism for their implementation [8,9,10,11]. A vulnerability is caused by at least one flaw and can be exploited by attacks. Attack or vulnerability taxonomies might be useful when developers (or administrators or testers) need to clarify the ways their target system can be attacked and the parts of the system that should be protected. Considering the fact that a flaw is the root cause of security violations and can be masked by another part of the system, its identification is more useful for making a target system robust to security threats. In this paper, we focus on flaws, rather than attacks or vulnerabilities

Results

Discussion

Conclusion