Thesis author: Maximilian Hense
Security patterns are a concept for documenting proven solutions to recurring security threats and making them reusable, and researchers have proposed about 500 of them over the last three decades. Most of these security patterns are documented at the conceptual design level and collected in catalogues. Such catalogues help to understand a pattern conceptually, but they do not reveal the actual complexity of its implementation, and no artefact guides a researcher from the abstract description to a concrete, running, and inspectable realisation. This thesis closes this gap with an observability framework for reference implementations of security patterns for authentication. The thesis follows Design Science Research with an incremental development process and contributes two results. The first is a domain model in which a security pattern is the composition of a UseCase, a Diagram, and a Code Model, interconnected through the code as their common anchor. The second is a framework that realises this domain model. It is deliberately designed using the strategy pattern so that additional security patterns can be integrated in future work. The framework is developed and demonstrated using three well-established security patterns catalogued by the DistriNet group: password-based, verifiable-token-based, and opaque-token-based authentication. The demonstration shows that the artefact exposes the source code, the runtime behaviour, and the security weaknesses of these patterns and links each back to its entry in the conceptual catalogue. Overall, the framework delivers an important contribution towards closing the gap between the abstract description of a security pattern in a catalogue and its concrete, running, and inspectable realisation.
