Skip to main content
DeutschDE
European Commission logo print header

A Platform for Risk Analysis of Security Critical Systems

Ziel

A major challenge for users and vendors of information and communication technology in Europe and world-wide is to implement security in a way that meets business needs cost-effectively, both in the short term and as enterprise needs expand. In order to meet this challenge, we need to improve the existing methods of identifying and analysing possible threats, and of specifying, designing and implementing security policies.

CORAS aims to develop a framework for precise, unambiguous, and efficient risk analysis of security critical systems. This framework will be built upon a selective integration of Risk Analysis techniques and semi-formal Object Oriented Modelling to support the formation, rigorous specification and endorsement of security policies.

The framework will be obtained through adapting, refining, extending, and combining methods for risk analysis, semi-formal object oriented modelling, and computerized tools (supporting the above mentioned methods). The integration of risk analysis and semiformal modelling will receive special emphasis.

In particular, for each analysis scenario considered:
.What are the relevant system properties?
.How should the relevant system properties be modelled using semiformal methods?
.How do we make optimal use of the resulting semiformal models during risk analysis?
.How do we represent the results from risk analysis (intermediate as well as final results)?
.What are the general rules for maintenance and reuse of such results?
.The CORAS framework will be tested and assessed in two major trials, one within telemedicine and one within e-commerce.

The contract for CORAS was signed by the European Commission in December 2000, and lasts for 30 months, from the 1st of January 2001 to the 30th of June 2003. The results from CORAS will, among others, be disseminated through the project's reports, papers, a public workshop and clustering activities. The CORAS consortium consists of 10 commercial companies and research institut
ions from 5 nations. The partners in the consortium are: Telenor Communications AS R&D (Norway), Intracom S.A. (Greece), Institute for energy technology (Norway), Norwegian Computing Center (Norway), SINTEF (Norway), Norwegian Centre of Telemedicine (Norway), Rutherford Appleton Labs (United Kingdom), Queen Marys and Westfield College (United Kingdom), Computer Technology Institute (Greece) and Solinet Gmbh (Germany). The project is co-ordinated by Telenor Communications AS R&D (administrative co-ordinator and responsible towards the European Commission), while SINTEF has the role as technical co-ordinator.

Objectives:
The overall objective for the project CORAS is to provide an integrated methodology to aid the design of secure systems and thus establish trust and confidence in products. The CORAS' main objectives are:

to develop a practical framework for a precise, unambiguous and efficient risk analysis, by exploiting the synthesis of risk analysis methods with semiformal specification methods (in particular, methods for object oriented modelling) and computerized tools, in order to improve the risk analysis of security critical systems;
to assess the applicability, usability and efficiency of the framework by extensive experimentation in the fields of e-commerce and telemedicine;
to investigate the method's commercial viability and pursue its exploitation within relevant market segments, while playing an influential role in standardization organizations.

Work description:
The work within CORAS is divided in 8 work packages (WP) with one responsible partner / co-ordinator for each WP:

WP1 - Project management (Telenor Communications AS R&D)
WP2 - Risk analysis of security critical systems (Institutt for energiteknikk)
WP3 - Specification and modelling methods for security critical systems (Sintef)
WP4 - Practical framework integrating methods, tools and techniques (Solinet)
WP5 - Trials to validate the approach (Intracom responsible for the e-commerce trials and Norwegian Centre of Telemedicine responsible for the telemedicine trials)
WP6 - Assessment and evaluation (Telenor Communications AS R&D)
WP7 - Exploitation (Norwegian Computing Center )
WP8 - Clustering (Telenor Communications R&D)
WP2 will further develop the risk analysis methodology for application to security critical systems, with special emphasis on taking advantage of formal and semiformal described security specifications.

It will be focused on how to increase the likelihood that all the potential vulnerabilities and security violations are taken into consideration in the development of security critical systems.
The overall objective of WP3 is to develop an RM-ODP inspired modelling framework specialized towards the identification and analysis of hazards in security critical systems.
In WP4 the overall goal is to integrate the results from WP2 and WP3 into a framework for identifying and analysing risks in security critical systems.
WP5 will demonstrate the applicability and evaluate the effectiveness of the CORAS framework through extensive experimentation in two trials, one within e-commerce and one within telemedicine. Exploitation as well as dissemination is very important for the CORAS consortium.
This work is organized in WP7.
Finally, WP8 is added for clustering activities.
WP1 and WP6 will ensure that the project is properly managed, resources are carefully spent and quality results are achieved in accordance with the project objectives and the established milestones.

Milestones:
The milestones in CORAS are:

Year 1:
Input of risk analysis methodology
Completion of state-of-the-art review draft procedure completed and input into trial planning
Specification of trial scenarios, test cases, as well as of assessment process and criteria

Year 2:
Semiformal model of the security critical parts of the trial applications based on the CORAS framework.
Risk analyses completed and list of security threats and countermeasures provided. Comparison with existing/conventional risk analyses methodology completed. Evaluation of the applicability, usefulness, and effectiveness of the CORAS framework in modelling and risk analysing the trial systems completed.

Year 3:
final report incorporating revisions from trials and implementation requirements, and evaluation of effectiveness of work package

Wissenschaftliches Gebiet

Programm/Programme

Thema/Themen

Aufforderung zur Vorschlagseinreichung

Data not available

Finanzierungsplan

CSC - Cost-sharing contracts

Koordinator

TELENOR COMMUNICATION II AS
EU-Beitrag
Keine Daten
Adresse
SNAROEYVEIEN 30
1331 FORNEBU
Norwegen

Auf der Karte ansehen
Gesamtkosten
Keine Daten

Beteiligte (10)

Diese Seite teilen

Herunterladen

Letzte Aktualisierung: 13 Juni 2005

Mein Booklet

Permalink: https://cordis.europa.eu/project/id/IST-2000-25031/de

European Union, 2024