Meeting Real Challenges in Eliciting Security Attributes for Mobile Application Development = Meeting Real Challenges in Eliciting Security Attributes for Mobile Application Development

다국어 초록 (Multilingual Abstract)

There has been a rapid growth in the development of mobile application resulting from its wide usage for online transaction, data storage and exchange of information. However, an important issue that has been overlooked is the lack of emphasis on the security issues at the early stage of the development. In fact, security issues have been kept until the later stage of the implementation of mobile apps. Requirements engineers frequently ignore and incorrectly elicit security-related requirements at the early stage of mobile application development. This scenario has led to the failure of developing secure and safe mobile application based on the needs of the users. As such, this paper intends to provide further understanding of the real challenges in extracting security attributes for mobile application faced by novice requirements engineers. For this purpose, two experiments on eliciting security attributes requirements of textual requirements scenario were conducted. The performance related to the correctness and time taken to elicit the security attributes were measured and recorded. It was found that the process of eliciting correct security attributes for mobile application requires effort, knowledge and skills. The findings indicate that an automated tool for correct elicitation security attributes requirement could help to overcome the challenges in eliciting security attributes requirements, especially among novice requirements engineers.

참고문헌 (Reference)

1 M.S.Ware, "Using the Common Criteria to Elicit Security Requirements with Use Cases" 273-278, 2005

2 C.L. Chen, "Using a Stored-Value Card to Provide an Added-Value Service of Payment Protocol in VANET" 660-665, 2013

3 "User Authentication in Mobile Access"

4 S. Yahya, "The Use of Essential Use Cases(EUCs)to enhance the Process of Capturing Security Requirements for Accurate Secure Software" 21-26, 2015

5 N.Yusop, "Security Requirements Validation for Mobile Apps: A Systematic Literature Review" 2015

6 C. B. Haley, "Security Requirements Engineering : A Framework for Representation and Analysis" 133-153, 2008

7 E. Paja, "STS-tool : Socio-technical Security Requirements through social commitments" 331-332, 2012

8 N. Nan, "Extractive Product Line Requirement"

9 B.J.Berger, "Extracting and Analyzing the Implemented Security Architecture of Business Applications" 2013

10 G.Ian, "Essential software architecture"

11 P. Aho, "Enhancing generated Java GUI models with valid test data" 310-315, 2011

12 S.Yahya, "Capturing Security Requirements Using Essential Use Cases (EUCs)" 16-30, 2014

13 P. Vilhan, "Building Public Key Infrastructure for MANET with Help of B. A. T. M. A. N. Advanced" 566-571, 2013

14 A. Kull, "Automatic GUI Model Generation: State of the Art" 207-212, 2012

15 N. Ranjbar, "Authentication and Authorization for Mobile Devices"

16 C. E.Loftis, "Attribute-level encryption of data in public Android databases" RTI Press

17 I. Kashmala, "Analytical Survey for Assuring and Maintaining Quality of Mobile Applications"

18 K.Ivo, "A comprehensive exploration of challenges in architecturebased reliability estimation" 202-227 : 2009

19 A. Rekha, "A Survey on Encryption Algorithms for Data Security" 131-134, 2017

20 S. Yahya, "A Review on Tool Supports for Security Requirements Engineering" 2013